Physics-Constrained Digital Twins for Sensor Integrity in Urban Pedestrian Flow: Detecting Stealthy False Data Injection with Conformal Guarantees

# Physics-Constrained Digital Twins for Sensor Integrity in Urban Pedestrian Flow: Detecting Stealthy False Data Injection with Conformal Guarantees
Source: [https://arxiv.org/html/2609.17635](https://arxiv.org/html/2609.17635)
\[orcid=0000\-0003\-2980\-9236\]

\[orcid=0009\-0004\-7280\-8057\]

\[orcid=0000\-0002\-6108\-6632\]

\[orcid=0000\-0002\-6367\-2694\]

\[orcid=0000\-0002\-8717\-442X\]

\{graphicalabstract\}

††highlights:Stealthy false data injection is formalised for sparse pedestrian sensing\. A conservation residual on the street graph enters the detection score\. The attack margin quantifies how far physics shrinks the stealthy set\.Oscar Mogollon Gutierrezoscarmg@unex\.esorganization=Department of Computer Systems and Telematics Engineering, Media Engineering Group \(GIM\), Universidad de Extremadura, addressline=Escuela Politécnica, Avda\. de la Universidad s/n, city=Cáceres, postcode=10003, country=SpainFatemeh GhasemiMohammadhossein Homaeihomaei@unex\.esAndres Caroandresc@unex\.esMar Avilammavila@unex\.es

###### Abstract

City pedestrian counting systems now feed economic indicators, planning decisions and safety operations, yet the twins built on top of them treat the incoming stream as ground truth\. We study what happens when it is not\. We formalise stealthy false data injection for city\-scale pedestrian sensing, where the map from latent flow to observation is far more rank deficient than in the power and water networks for which stealth has been characterised\. Our twin estimates directed flows on the pedestrian street graph, assimilates counts through a learned graph\-localised gain, and is trained against a flow conservation residual that couples metered and unmetered segments\. Detection combines the innovation with that residual, and the alarm threshold is set by adaptive conformal calibration rather than by hand\. To measure what the physics buys, we define the attack margin, the relative reduction in worst\-case corruption of the estimated flow field, achieved against a white\-box adversary that optimises directly through the twin\. On six years of Melbourne data the margin reaches 0\.54 against a single compromised device and falls to 0\.19 when a third of the fleet is compromised, on a network where only 1\.18 per cent of walkable segments are metered\. Replacing the street graph by a distance graph collapses it to 0\.09, which shows that the gain comes from the conservation law rather than from locality\.

###### keywords

digital twin ,pedestrian sensing ,false data injection ,flow conservation ,conformal prediction ,cyber\-physical security

††credit:Conceptualization, Validation, Investigation, Supervision, Writing – review and editing, Project administration††credit:Conceptualization, Methodology, Software, Formal analysis, Writing – original draft, Visualization††credit:Methodology, Validation, Data curation, Writing – review and editing††credit:Supervision, Resources, Funding acquisition, Writing – review and editing††credit:Supervision, Resources, Writing – review and editing††corresponding:Corresponding author## 1Introduction

Cities now count their pedestrians continuously\. Fixed counters report at fixed intervals for years at a time, and the resulting archives have become infrastructure rather than curiosities\.[Yanotti et al\. \[45\]](https://arxiv.org/html/2609.17635#bib.bib26)nowcast regional retail turnover from Melbourne footfall,[Sevtsuk et al\. \[36\]](https://arxiv.org/html/2609.17635#bib.bib27)calibrate a network flow model of the same city against its sensors, and[Altin et al\. \[2\]](https://arxiv.org/html/2609.17635#bib.bib28)build a public forecasting benchmark on the archive\. The modelling layer above these streams has moved from static replicas towards synchronised ones\.[Casadei et al\. \[7\]](https://arxiv.org/html/2609.17635#bib.bib1)propose a reference architecture for crowd digital twins, and[Yano et al\. \[44\]](https://arxiv.org/html/2609.17635#bib.bib3)treat continuous correction by observation, rather than prediction alone, as the defining difficulty\.

These counters are unattended networked devices on public streets\. Their error has been studied as a measurement problem, through validation against manual counts\[[5](https://arxiv.org/html/2609.17635#bib.bib29)\]and through reliability testing of infrared units\[[34](https://arxiv.org/html/2609.17635#bib.bib30)\]\. Deliberate corruption has not\. In power systems and water networks the corresponding question is old, and the answer is uncomfortable\. An injection that respects the governing equations can move a state estimate without moving a residual\[[20](https://arxiv.org/html/2609.17635#bib.bib4),[1](https://arxiv.org/html/2609.17635#bib.bib7)\]\. Learned detectors do not close the gap, because they treat network structure as a statistical prior to be estimated\[[21](https://arxiv.org/html/2609.17635#bib.bib12)\], and because their alarm thresholds are typically set by hand\[[27](https://arxiv.org/html/2609.17635#bib.bib31)\]\.

Pedestrian sensing inherits this exposure in a sharper form\. A city instruments a few dozen segments out of many thousands, so the map from latent flow to observation is severely rank deficient and an attacker has a large null space to hide in\. The street network, however, imposes something the sensors cannot see around\. Pedestrians are not created at junctions\. Flow conservation holds on the whole graph, including the unmetered parts, and it holds independently of any learned parameter\. This raises the question the paper answers\. Does encoding that law measurably narrow what a stealthy adversary can achieve, or does it only make the twin look more physical?

#### Contributions\.

1. \[\(i\)\]
2. 1\.We formalise sensor integrity for city\-scale pedestrian counting, define the set ofη\\eta\-stealthy injections under an access budget, and introduce the*attack margin*as the reduction in worst\-case flow corruption attributable to a physical constraint \(Section[3](https://arxiv.org/html/2609.17635#S3)\)\.
3. 2\.We build a twin that estimates latent directed flows on the street graph, assimilates counts through a learned graph\-localised gain, and is trained against a conservation residual with a bounded source and sink envelope \(Section[4](https://arxiv.org/html/2609.17635#S4)\)\.
4. 3\.We combine that residual with the innovation into one detection score whose threshold is calibrated conformally and adapted online under seasonal drift\.
5. 4\.We evaluate against a white\-box adversary that optimises directly through the twin, compare all baselines at a matched false\-alarm rate, and report the attack margin as a function of the access budget \(Section[5](https://arxiv.org/html/2609.17635#S5)\)\.

Section[2](https://arxiv.org/html/2609.17635#S2)positions the work\. Section[3](https://arxiv.org/html/2609.17635#S3)states the threat model and the three problems\. Section[4](https://arxiv.org/html/2609.17635#S4)describes the pipeline\. Section[5](https://arxiv.org/html/2609.17635#S5)reports the experiments, Section[6](https://arxiv.org/html/2609.17635#S6)discusses limitations, and Section[7](https://arxiv.org/html/2609.17635#S7)concludes\.

## 2Related Works

### 2\.1Pedestrian Counting Infrastructure and Urban Digital Twins

City pedestrian counting programmes have become measurement infrastructure\.[Yanotti et al\. \[45\]](https://arxiv.org/html/2609.17635#bib.bib26)use fifteen years of Melbourne footfall to nowcast state retail turnover, which shows what these counts are now trusted to support\.[Sevtsuk et al\. \[36\]](https://arxiv.org/html/2609.17635#bib.bib27)model flows across the Melbourne walkway network and calibrate them against the same sensors, and[Altin et al\. \[2\]](https://arxiv.org/html/2609.17635#bib.bib28)turn the archive into a forecasting benchmark with chronological splits\. The accuracy of the devices is treated as a measurement question\.[Bakhshi et al\. \[5\]](https://arxiv.org/html/2609.17635#bib.bib29)estimate how many hours of manual counting are needed before a correction function can be trusted, and[Ryan and Benton \[34\]](https://arxiv.org/html/2609.17635#bib.bib30)report the reliability limits of infrared counters over a full year\. Twins built on such streams are maturing in parallel\.[Casadei et al\. \[7\]](https://arxiv.org/html/2609.17635#bib.bib1)give a reference architecture for crowd digital twins,[Napolitano et al\. \[31\]](https://arxiv.org/html/2609.17635#bib.bib2)observe that mobility twins remain fragmented and tied to one deployment, and[Yano et al\. \[44\]](https://arxiv.org/html/2609.17635#bib.bib3)treat assimilation as the hard problem rather than prediction\. One assumption runs through all of it\. Counting error is accidental\. The possibility that a device reports what someone chose for it to report is never modelled\.

### 2\.2False Data Injection and Sensor Integrity in Cyber\-Physical Systems

The formal treatment of stealth begins in power systems\.[Jin et al\. \[20\]](https://arxiv.org/html/2609.17635#bib.bib4)derive necessary and sufficient conditions for completely stealthy sensor attacks when the adversary reaches only a constrained subset of channels, and they show that deeper stealth demands stronger conditions on the system dynamics\.[Xu et al\. \[43\]](https://arxiv.org/html/2609.17635#bib.bib5)extend the argument to distributed estimation, where a bias injected at one node must stay consistent with the detectors of every neighbour\.[An et al\. \[3\]](https://arxiv.org/html/2609.17635#bib.bib6)formalise how such an injection propagates across partitions\. The same reasoning has recently reached water networks\.[Albustami and Taha \[1\]](https://arxiv.org/html/2609.17635#bib.bib7)show that attacks which respect hydraulic conservation persist for long periods while requiring only local knowledge of the targeted sensors\. Detection has moved in parallel\.[Vincent et al\. \[38\]](https://arxiv.org/html/2609.17635#bib.bib8)and[Xia et al\. \[40\]](https://arxiv.org/html/2609.17635#bib.bib9)exploit grid topology through graph convolution, while[Khan et al\. \[22\]](https://arxiv.org/html/2609.17635#bib.bib10)and[Homaei et al\. \[18\]](https://arxiv.org/html/2609.17635#bib.bib11)use a digital twin as a reference model for localisation and root cause analysis\. A second tradition bounds the damage instead of flagging it: physical watermarking\[[28](https://arxiv.org/html/2609.17635#bib.bib41)\]injects a secret excitation an attacker cannot reproduce, and resilient state estimation\[[14](https://arxiv.org/html/2609.17635#bib.bib42)\]recovers the state exactly when fewer than half the channels are corrupted\. Watermarking does not transfer, because a counter cannot be actuated, and the half\-corruption bound is vacuous under a rank\-deficient𝐂\\mathbf\{C\}; the resilient estimator nevertheless gives the strongest principled baseline available to us and we report it\. Two properties are shared across this literature\. The physics is an analytic model, and the measurement set carries enough redundancy for the state to be observable\. Pedestrian sensing offers neither\. The selection operator is far more rank deficient, and the readings are integer counts with heavy overdispersion rather than continuous phasor or pressure signals\. Whether the unobservability result survives that change is an open question\.

### 2\.3Graph\-Based and Physics\-Constrained Anomaly Detection

Graph based detectors now dominate multivariate anomaly detection\. The survey of[Jin et al\. \[21\]](https://arxiv.org/html/2609.17635#bib.bib12)maps the field and makes its shared assumption visible\. The graph is treated as a statistical object to be estimated, not as a physical law to be obeyed\. CST\-GL\[[48](https://arxiv.org/html/2609.17635#bib.bib13)\]infers pairwise correlations between series and builds a spatio temporal network on top of them\. GSC\-MAD\[[47](https://arxiv.org/html/2609.17635#bib.bib14)\]goes one step further and scores anomalies by how much the inferred structure itself changes\. An adversary who preserves the learned correlations therefore stays invisible to both\. A second line of work injects physics into the model\.[Wu et al\. \[39\]](https://arxiv.org/html/2609.17635#bib.bib15)and[Zideh et al\. \[49\]](https://arxiv.org/html/2609.17635#bib.bib16)review how physical laws enter as soft penalties or engineered features in condition monitoring and in power measurement screening\. Closest to our setting,[Homaei et al\. \[17\]](https://arxiv.org/html/2609.17635#bib.bib17)feed normalised conservation law violations into a graph attention network for water distribution, and[Du et al\. \[13\]](https://arxiv.org/html/2609.17635#bib.bib18)embed mass conservation as domain knowledge to improve generalisation to unseen operating conditions\. In every case the constraint is used to raise accuracy under benign faults\. Whether it also removes degrees of freedom from an adversary is not asked\.

### 2\.4Calibrated Detection Thresholds and Honest Evaluation

Alarm thresholds are usually chosen by hand, and the cost is now documented\.[Massaad et al\. \[27\]](https://arxiv.org/html/2609.17635#bib.bib31)reinterpret the reconstruction error threshold of a CAN bus intrusion detector as a conformal quantile and recover a statistical meaning for the alarm rate\.[Diallo et al\. \[11\]](https://arxiv.org/html/2609.17635#bib.bib32)compare conformal thresholds against the classical limits used with principal component analysis and autoencoders, and[Mudasir et al\. \[30\]](https://arxiv.org/html/2609.17635#bib.bib33)write an explicit false alarm budget into the detector itself\. The obstacle in our setting is exchangeability\.[Zaffran et al\. \[46\]](https://arxiv.org/html/2609.17635#bib.bib34)analyse adaptive conformal inference on dependent series and show how the learning rate governs its efficiency\.[Xu and Xie \[42\]](https://arxiv.org/html/2609.17635#bib.bib35)bound the coverage gap without assuming exchangeability, and[Oliveira et al\. \[32\]](https://arxiv.org/html/2609.17635#bib.bib36)prove that split conformal survives many non\-exchangeable processes at the price of a coverage penalty\. Closest to us in spirit,[Xiao et al\. \[41\]](https://arxiv.org/html/2609.17635#bib.bib37)combine physical guidance with distributional robustness for injection detection under drift, although the threshold there is not calibrated\. Evaluation is the other half\.[Sarfraz et al\. \[35\]](https://arxiv.org/html/2609.17635#bib.bib38)and[Liu and Paparrizos \[25\]](https://arxiv.org/html/2609.17635#bib.bib39)show that point adjusted scores flatter near random detectors, and[Sørbø and Ruocco \[37\]](https://arxiv.org/html/2609.17635#bib.bib40)organise the alternatives into a usable taxonomy\. We follow their recommendations rather than defending a headline score\.

### 2\.5Adversarial Robustness of Learned Detectors

A learned detector is itself an attack surface, and recent work says so clearly\.[Bai et al\. \[4\]](https://arxiv.org/html/2609.17635#bib.bib19)generate evasive inputs that still preserve the functionality of the underlying attack, which is the right requirement once the target is a physical process rather than a classifier\. NOAE\[[16](https://arxiv.org/html/2609.17635#bib.bib20)\]shows that current multivariate detectors for industrial telemetry fall to optimised perturbations\. The training phase is equally exposed\.[Islam et al\. \[19\]](https://arxiv.org/html/2609.17635#bib.bib21)poison the quantile regression that learns the alarm threshold, and a physics\-informed budget has been used to corrupt archived load records before a grid detector is ever trained\[[12](https://arxiv.org/html/2609.17635#bib.bib22)\]\. Two studies come close to our threat model\. SAAs\[[24](https://arxiv.org/html/2609.17635#bib.bib23)\]run projected gradient descent inside a physically consistent subspace, because perturbations that ignore inter\-channel structure produce ghost data that spatiotemporal detectors reject\. G\-DCAP\[[15](https://arxiv.org/html/2609.17635#bib.bib24)\]learns domain constraints on a graph and propagates perturbations along it to stay coherent\. Certification remains thin, and the one guarantee we found\[[26](https://arxiv.org/html/2609.17635#bib.bib25)\]holds under a temporal alignment metric rather than a physical law\. In all of this the physics serves the attacker\. Nobody measures how much a hard conservation constraint shrinks the feasible set on the defending side\.

## 3Problem Formulation

This section makes precise what we mean by a pedestrian digital twin, what an adversary is allowed to do to it, and what it means for that adversary to succeed\. We deliberately separate the three, because much of the existing literature on anomaly detection in urban sensing conflates “an unusual reading” with “an attacked reading”, and the two are not the same object\. A crowd surge and a replayed counter both look anomalous; only one of them is adversarial, and only one of them can be shaped to hide below a detection threshold\.

### 3\.1Sensing Substrate and Notation

We consider a city\-scale pedestrian counting deployment such as the Melbourne Pedestrian Counting System\[[9](https://arxiv.org/html/2609.17635#bib.bib44)\], in which a set of fixed sensors report periodic counts of pedestrians passing beneath them\. Let

𝒱=\{v1,v2,…,vN\}\\mathcal\{V\}=\\\{v\_\{1\},v\_\{2\},\\dots,v\_\{N\}\\\}\(1\)denote the set ofNNdeployed counters, and lett∈\{1,…,T\}t\\in\\\{1,\\dots,T\\\}index a uniform sampling grid of resolutionΔ\\Delta\(one hour for the archival stream, one minute for the directional real\-time stream\)\. The count reported by sensorviv\_\{i\}during intervalttis writtenyi​\(t\)∈ℤ≥0y\_\{i\}\(t\)\\in\\mathbb\{Z\}\_\{\\geq 0\}, and the full measurement vector is

𝐲⁡\(t\)=\[y1​\(t\),y2​\(t\),…,yN​\(t\)\]⊤∈ℤ≥0N\.\\mathbf\{y\}\(t\)=\\big\[\\,y\_\{1\}\(t\),\\,y\_\{2\}\(t\),\\,\\dots,\\,y\_\{N\}\(t\)\\,\\big\]^\{\\\!\\top\}\\in\\mathbb\{Z\}\_\{\\geq 0\}^\{N\}\.\(2\)
The counters are not free\-floating time series: they sit on a physical street network, and that network constrains how the quantities they measure can jointly evolve\. We encode the network as a directed graph

𝒢=\(𝒩,ℰ\),\|𝒩\|=Mn,\|ℰ\|=Me,\\mathcal\{G\}=\\big\(\\mathcal\{N\},\\mathcal\{E\}\\big\),\\qquad\|\\mathcal\{N\}\|=M\_\{\\mathrm\{n\}\},\\qquad\|\\mathcal\{E\}\|=M\_\{\\mathrm\{e\}\},\(3\)extracted from OpenStreetMap\[[33](https://arxiv.org/html/2609.17635#bib.bib46)\]and restricted to the pedestrian\-accessible subnetwork, where𝒩\\mathcal\{N\}is the set of junctions andℰ\\mathcal\{E\}the set of directed walkable segments\. The archival stream is undirected, so a counter reports the sum of both walking directions on the street beneath it\. Writingei\+,ei−e\_\{i\}^\{\+\},e\_\{i\}^\{\-\}for that antiparallel segment pair, map matching defines a sparse selection operator

𝐂∈\{0,1\}N×Me,Ci​j=𝟏\[ej∈\{ei\+,ei−\}\],\\mathbf\{C\}\\in\\\{0,1\\\}^\{N\\times M\_\{\\mathrm\{e\}\}\},\\qquad C\_\{ij\}=\\mathbf\{1\}\\big\[\\,e\_\{j\}\\in\\\{e\_\{i\}^\{\+\},e\_\{i\}^\{\-\}\\\}\\,\\big\],\(4\)
so each row carries two unit entries and the directional split stays latent\. BecauseN≪MeN\\ll M\_\{\\mathrm\{e\}\}in every real deployment we are aware of,𝐂\\mathbf\{C\}is a wide, heavily rank\-deficient operator, which Section[3\.5](https://arxiv.org/html/2609.17635#S3.SS5)turns into a dimension count\.

Finally, we writeϕ⁡\(t\)∈ℝ≥0Me\\bm\{\\phi\}\(t\)\\in\\mathbb\{R\}\_\{\\geq 0\}^\{M\_\{\\mathrm\{e\}\}\}for the vector of latent directed pedestrian flows on all segments, and𝐮⁡\(t\)∈ℝp\\mathbf\{u\}\(t\)\\in\\mathbb\{R\}^\{p\}for observable exogenous covariates \(temperature, precipitation, day\-of\-week, public holiday and event indicators\)\. Table[1](https://arxiv.org/html/2609.17635#S3.T1)collects the notation\.

### 3\.2The Digital Twin as a Constrained State\-Space Model

We define the twin not as a forecaster but as a synchronised state estimator, which is the property that distinguishes a digital twin from a digital model in the taxonomy of[Kritzinger et al\. \[23\]](https://arxiv.org/html/2609.17635#bib.bib43)\. Concretely, the twin maintains a latent state𝐱⁡\(t\)∈ℝd\\mathbf\{x\}\(t\)\\in\\mathbb\{R\}^\{d\}that is updated by every incoming observation and that evolves according to

𝐱⁡\(t\+1\)\\displaystyle\\mathbf\{x\}\(t\+1\)=f𝜽​\(𝐱⁡\(t\),𝐮⁡\(t\)\)\+𝐰⁡\(t\),\\displaystyle=f\_\{\\bm\{\\theta\}\}\\big\(\\mathbf\{x\}\(t\),\\,\\mathbf\{u\}\(t\)\\big\)\+\\mathbf\{w\}\(t\),\(5\)ϕ⁡\(t\)\\displaystyle\\bm\{\\phi\}\(t\)=g𝜽​\(𝐱​\(t\)\),\\displaystyle=g\_\{\\bm\{\\theta\}\}\\big\(\\mathbf\{x\}\(t\)\\big\),\(6\)𝐲⁡\(t\)\\displaystyle\\mathbf\{y\}\(t\)=𝐂​ϕ​\(t\)\+𝐯⁡\(t\),\\displaystyle=\\mathbf\{C\}\\,\\bm\{\\phi\}\(t\)\+\\mathbf\{v\}\(t\),\(7\)wheref𝜽f\_\{\\bm\{\\theta\}\}is a graph attention network operating on𝒢\\mathcal\{G\},g𝜽g\_\{\\bm\{\\theta\}\}is a non\-negative decoder,𝐰⁡\(t\)\\mathbf\{w\}\(t\)is process noise and𝐯⁡\(t\)\\mathbf\{v\}\(t\)is sensor noise\. We write𝐱^​\(t∣t\)\\hat\{\\mathbf\{x\}\}\(t\\mid t\)for the filtered state estimate obtained after assimilating𝐲⁡\(t\)\\mathbf\{y\}\(t\), and𝐲^​\(t∣t−1\)=𝐂​g𝜽​\(f𝜽​\(𝐱^​\(t−1∣t−1\),𝐮⁡\(t−1\)\)\)\\hat\{\\mathbf\{y\}\}\(t\\mid t\-1\)=\\mathbf\{C\}\\,g\_\{\\bm\{\\theta\}\}\(f\_\{\\bm\{\\theta\}\}\(\\hat\{\\mathbf\{x\}\}\(t\-1\\mid t\-1\),\\mathbf\{u\}\(t\-1\)\)\)for the one\-step\-ahead predicted measurement\.

#### Flow conservation\.

The physical constraint we exploit is elementary but, to our knowledge, unused in this setting: pedestrians are neither created nor destroyed at a street junction, except through identifiable sources and sinks \(building entrances, transit stops, car parks\)\. Letting𝐁∈\{−1,0,1\}Mn×Me\\mathbf\{B\}\\in\\\{\-1,0,1\\\}^\{M\_\{\\mathrm\{n\}\}\\times M\_\{\\mathrm\{e\}\}\}be the incidence matrix of𝒢\\mathcal\{G\}, conservation at junctionnnover intervalttreads

∑e∈δ−​\(n\)ϕe​\(t\)−∑e∈δ\+​\(n\)ϕe​\(t\)=sn​\(t\),\\sum\_\{e\\in\\delta^\{\-\}\(n\)\}\\phi\_\{e\}\(t\)\\;\-\\;\\sum\_\{e\\in\\delta^\{\+\}\(n\)\}\\phi\_\{e\}\(t\)\\;=\\;s\_\{n\}\(t\),\(8\)or compactly, for the whole network,

𝐁​ϕ​\(t\)=𝐬⁡\(t\),\\mathbf\{B\}\\,\\bm\{\\phi\}\(t\)=\\mathbf\{s\}\(t\),\(9\)where𝐬⁡\(t\)∈ℝMn\\mathbf\{s\}\(t\)\\in\\mathbb\{R\}^\{M\_\{\\mathrm\{n\}\}\}collects the net source–sink rate at each junction\. Two idealisations are explicit here\. Mid\-segment sources such as shop doors are attributed to the nearer endpoint of their segment, and the within\-interval storage term is folded intosn​\(t\)s\_\{n\}\(t\), which is admissible atΔ=1\\Delta=1h because a segment empties in minutes\. Both loosen the constraint, so the attack margin we report is biased downwards rather than optimistically\. Since𝐬⁡\(t\)\\mathbf\{s\}\(t\)is neither known exactly nor identically zero, we treat it as a slowly varying latent quantity with a bounded, learned envelope, and define the*conservation residual*

𝐫​\(t\)=𝐁​ϕ^​\(t\)−𝐬^​\(t\),\\mathbf\{r\}\(t\)\\;=\\;\\mathbf\{B\}\\,\\hat\{\\bm\{\\phi\}\}\(t\)\-\\hat\{\\mathbf\{s\}\}\(t\),\(10\)which under attack\-free operation concentrates near zero\. Two remarks are in order\. First, \([9](https://arxiv.org/html/2609.17635#S3.E9)\) is an equality on the*latent*flow vector, not on the measurements; it therefore couples metered and unmetered segments and propagates information into parts of the network that carry no sensor\. Second, it is a hard structural fact about the graph, independent of the learned parameters𝜽\\bm\{\\theta\}, which is precisely why an attacker cannot simply learn around it\.

###### Assumption 1\(Attack\-free calibration window\)\.

There exists a contiguous window𝒯cal⊂\{1,…,T\}\\mathcal\{T\}\_\{\\mathrm\{cal\}\}\\subset\\\{1,\\dots,T\\\}during which no sensor is compromised, and which is representative of the operating regime in the sense of seasonal and weekly coverage\.

Assumption[1](https://arxiv.org/html/2609.17635#Thmassumption1)is standard and, since the calibration window is drawn from the archive while the threat model concerns the live stream, an operator can at least audit it offline\. It is not verifiable, and an adversary reaching the archive corrupts the guarantee before the detector runs\.

### 3\.3Adversary Model

We assume an adversary who has obtained write access to a bounded subset of the sensing infrastructure — through the field bus, the gateway, or the ingestion API — but who cannot alter the physical world and cannot modify the twin’s parameters\. The adversary corrupts the measurement stream as

𝐲~​\(t\)=𝐲⁡\(t\)\+𝐚⁡\(t\),supp⁡\(𝐚⁡\(t\)\)⊆𝒦,\|𝒦\|≤κ,\\tilde\{\\mathbf\{y\}\}\(t\)\\;=\\;\\mathbf\{y\}\(t\)\\;\+\\;\\mathbf\{a\}\(t\),\\qquad\\operatorname\{supp\}\\big\(\\mathbf\{a\}\(t\)\\big\)\\subseteq\\mathcal\{K\},\\qquad\|\\mathcal\{K\}\|\\leq\\kappa,\(11\)where𝒦⊆𝒱\\mathcal\{K\}\\subseteq\\mathcal\{V\}is the compromised set andκ\\kappais the adversary’s access budget\. Physical realisability imposes the further requirement that the falsified stream remain a plausible count,

𝐲~​\(t\)∈ℤ≥0N,y~i​\(t\)≤yimax,\\tilde\{\\mathbf\{y\}\}\(t\)\\in\\mathbb\{Z\}\_\{\\geq 0\}^\{N\},\\qquad\\tilde\{y\}\_\{i\}\(t\)\\leq y\_\{i\}^\{\\max\},\(12\)withyimaxy\_\{i\}^\{\\max\}the saturation count of the device\. We instantiate four attack families, which together span the manipulations reported in the industrial\-control and smart\-metering literature:

\(A1\) Replay:y~i​\(t\)=yi​\(t−τ\),i∈𝒦,\\displaystyle\\tilde\{y\}\_\{i\}\(t\)=y\_\{i\}\(t\-\\tau\),\\quad i\\in\\mathcal\{K\},\(13\)\(A2\) Ramp bias:ai​\(t\)=βi​min⁡\(1,t−t0ρ\),ρ≫1,\\displaystyle a\_\{i\}\(t\)=\\beta\_\{i\}\\,\\min\\\!\\Big\(1,\\,\\tfrac\{t\-t\_\{0\}\}\{\\rho\}\\Big\),\\quad\\rho\\gg 1,\(14\)\(A3\) Scaling:y~i​\(t\)=⌊γi​yi​\(t\)⌉,γi≠1,\\displaystyle\\tilde\{y\}\_\{i\}\(t\)=\\big\\lfloor\\gamma\_\{i\}\\,y\_\{i\}\(t\)\\big\\rceil,\\quad\\gamma\_\{i\}\\neq 1,\(15\)\(A4\) Coordinated:𝐚⁡\(t\)=𝐂​𝐜​\(t\),𝐜⁡\(t\)∈ℝMe\.\\displaystyle\\mathbf\{a\}\(t\)=\\mathbf\{C\}\\,\\mathbf\{c\}\(t\),\\quad\\mathbf\{c\}\(t\)\\in\\mathbb\{R\}^\{M\_\{\\mathrm\{e\}\}\}\.\(16\)
Families \(A1\)–\(A3\) act sensor\-wise and are the ones an opportunistic attacker can mount\. Family \(A4\) is the dangerous one: by choosing𝐜⁡\(t\)\\mathbf\{c\}\(t\)to be consistent with some fictitious flow field, the adversary produces a corruption that is internally coherent across sensors and therefore invisible to any detector that only tests for statistical irregularity\. This is the pedestrian\-sensing analogue of the classical unobservable false data injection attack against power\-system state estimation, and it motivates the stealth analysis that follows\.

### 3\.4Detection Statistic and Calibrated Alarm Threshold

The twin monitors two residuals: the innovation between what it predicted and what it received, and the conservation residual of \([10](https://arxiv.org/html/2609.17635#S3.E10)\)\. We combine them into a single scalar score

z⁡\(t\)=‖𝐲~​\(t\)−𝐲^​\(t∣t−1\)‖𝚺−12\+λ​‖𝐫⁡\(t\)‖22,z\(t\)\\;=\\;\\big\\\|\\tilde\{\\mathbf\{y\}\}\(t\)\-\\hat\{\\mathbf\{y\}\}\(t\\mid t\-1\)\\big\\\|\_\{\\bm\{\\Sigma\}^\{\-1\}\}^\{2\}\\;\+\\;\\lambda\\,\\big\\\|\\mathbf\{r\}\(t\)\\big\\\|\_\{2\}^\{2\},\(17\)where𝚺\\bm\{\\Sigma\}is the innovation covariance estimated on𝒯cal\\mathcal\{T\}\_\{\\mathrm\{cal\}\}andλ≥0\\lambda\\geq 0trades statistical evidence against structural evidence\. Settingλ=0\\lambda=0recovers a conventional residual detector; the contribution of this work lies in characterising what is gained asλ\\lambdagrows\.

Rather than fixing an alarm threshold heuristically, we calibrate it conformally\. Treatingz⁡\(t\)z\(t\)as a non\-conformity score and lettingncal=\|𝒯cal\|n\_\{\\mathrm\{cal\}\}=\|\\mathcal\{T\}\_\{\\mathrm\{cal\}\}\|, we set

ηα=⌈\(1−α\)​\(ncal\+1\)⌉​\-th smallest value of​\{z⁡\(t\)\}t∈𝒯cal,\\eta\_\{\\alpha\}\\;=\\;\\Big\\lceil\(1\-\\alpha\)\\,\(n\_\{\\mathrm\{cal\}\}\+1\)\\Big\\rceil\\text\{\-th smallest value of \}\\big\\\{z\(t\)\\big\\\}\_\{t\\in\\mathcal\{T\}\_\{\\mathrm\{cal\}\}\},\(18\)and declare an alarm at timettwhenever

δ\(t\)=1\[z\(t\)\>ηα\]=1\.\\delta\(t\)\\;=\\;\\mathbf\{1\}\\big\[\\,z\(t\)\>\\eta\_\{\\alpha\}\\,\\big\]\\;=\\;1\.\(19\)Under exchangeability of the calibration and test scores, this construction guarantees a marginal false\-alarm rate of at mostα\\alpha,

ℙ\[z\(t\)\>ηα\]≤α\.\\mathbb\{P\}\\big\[\\,z\(t\)\>\\eta\_\{\\alpha\}\\,\\big\]\\;\\leq\\;\\alpha\.\(20\)Exchangeability is of course violated by seasonal drift in pedestrian activity, and we therefore adopt an adaptive online variant in whichα\\alphais updated from the realised error rate; the finite\-sample statement \([20](https://arxiv.org/html/2609.17635#S3.E20)\) should be read as the idealised target that the adaptive scheme tracks\.

### 3\.5Stealthy Attacks and the Attack Margin

An attack is useful to the adversary only if it moves the twin’s state and useless if it triggers the alarm\. This suggests the following definition\.

###### Definition 1\(η\\eta\-stealthy attack\)\.

Given an alarm thresholdη\\eta, a horizonℋ=\{t0,…,t0\+H\}\\mathcal\{H\}=\\\{t\_\{0\},\\dots,t\_\{0\}\+H\\\}and an access budgetκ\\kappa, an injection sequence𝐚⁡\(⋅\)\\mathbf\{a\}\(\\cdot\)is*η\\eta\-stealthy*if it satisfies \([11](https://arxiv.org/html/2609.17635#S3.E11)\)–\([12](https://arxiv.org/html/2609.17635#S3.E12)\) and

z⁡\(t\)≤ηfor all​t∈ℋ\.z\(t\)\\;\\leq\\;\\eta\\qquad\\text\{for all \}t\\in\\mathcal\{H\}\.\(21\)We write𝒜κ​\(η,λ\)\\mathcal\{A\}\_\{\\kappa\}\(\\eta,\\lambda\)for the set of all such sequences, making explicit its dependence on the constraint weightλ\\lambda\.

The adversary’s objective is to maximally corrupt the twin’s belief about the world while remaining inside𝒜κ​\(η,λ\)\\mathcal\{A\}\_\{\\kappa\}\(\\eta,\\lambda\)\. Measuring corruption by the deviation of the estimated flow field, the worst\-case attack solves

ℐ⋆​\(κ,λ\)=max𝐚⁡\(⋅\)\\displaystyle\\mathcal\{I\}^\{\\star\}\(\\kappa,\\lambda\)\\;=\\;\\max\_\{\\mathbf\{a\}\(\\cdot\)\}1H​∑t∈ℋ‖ϕ^𝐚​\(t∣t\)−ϕ^​\(t∣t\)‖1‖ϕ^​\(t∣t\)‖1\\displaystyle\\frac\{1\}\{H\}\\sum\_\{t\\in\\mathcal\{H\}\}\\frac\{\\big\\\|\\hat\{\\bm\{\\phi\}\}^\{\\,\\mathbf\{a\}\}\(t\\mid t\)\-\\hat\{\\bm\{\\phi\}\}\(t\\mid t\)\\big\\\|\_\{1\}\}\{\\big\\\|\\hat\{\\bm\{\\phi\}\}\(t\\mid t\)\\big\\\|\_\{1\}\}\(22\)subject to\\displaystyle\\text\{subject to\}𝐚⁡\(⋅\)∈𝒜κ​\(ηα,λ\),\\displaystyle\\mathbf\{a\}\(\\cdot\)\\in\\mathcal\{A\}\_\{\\kappa\}\(\\eta\_\{\\alpha\},\\lambda\),whereϕ^𝐚\\hat\{\\bm\{\\phi\}\}^\{\\,\\mathbf\{a\}\}is the flow field the twin estimates under corruption\. We score the attack in flow space, not in the latent state, because the detectors compared in \([23](https://arxiv.org/html/2609.17635#S3.E23)\) are separately trained and do not share a latent parameterisation, so a latent\-space norm would reward a model that merely rescales𝐱\\mathbf\{x\}\. The relativeℓ1\\ell\_\{1\}form reads as the fraction of pedestrian\-hours the adversary succeeds in misattributing, and the margin \([23](https://arxiv.org/html/2609.17635#S3.E23)\) is invariant to its normalisation\. Problem \([22](https://arxiv.org/html/2609.17635#S3.E22)\) is non\-convex, and we solve it approximately by projected gradient ascent through the differentiable twin, which yields a lower bound on the true worst case and is therefore a conservative — and honest — characterisation of the attack surface\.

The quantity of interest for defence is how much the conservation term shrinks this attack surface\. We define the*attack margin*as the relative reduction in worst\-case impact attributable toλ\\lambda,

ℳ⁡\(κ\)=1−ℐ⋆​\(κ,λ\)ℐ⋆​\(κ,0\),ℳ⁡\(κ\)∈\[0,1\]\.\\mathcal\{M\}\(\\kappa\)\\;=\\;1\\;\-\\;\\frac\{\\mathcal\{I\}^\{\\star\}\(\\kappa,\\lambda\)\}\{\\mathcal\{I\}^\{\\star\}\(\\kappa,0\)\},\\qquad\\mathcal\{M\}\(\\kappa\)\\in\[0,1\]\.\(23\)Informally,ℳ=0\\mathcal\{M\}=0means the physical constraint bought us nothing and the attacker can do just as much damage as before, while values close to one mean the coherent\-looking corruptions of family \(A4\) have been forced into a much narrower subspace\. The following characterisation bounds how narrow that subspace can become\.

###### Proposition 1\(Dimension of the completely stealthy set\)\.

Let𝐚⁡\(t\)=𝐂​𝐜​\(t\)\\mathbf\{a\}\(t\)=\\mathbf\{C\}\\,\\mathbf\{c\}\(t\)be an injection of family \(A4\), so that the corruption is consistent with the fictitious flow perturbation𝐜⁡\(t\)\\mathbf\{c\}\(t\)\. Atλ=0\\lambda=0the score \([17](https://arxiv.org/html/2609.17635#S3.E17)\) depends on the injection only through the uncompromised channels, so it is unchanged for every𝐜\\mathbf\{c\}invisible there, and the stealthy directions form

𝒮κ\(0\)=\{𝐜:\[𝐂𝐜\]i=0∀vi∉𝒦\},dim𝒮κ\(0\)=Me−\(N−κ\)\.\\mathcal\{S\}\_\{\\kappa\}\(0\)=\\big\\\{\\mathbf\{c\}:\[\\mathbf\{C\}\\mathbf\{c\}\]\_\{i\}=0\\ \\ \\forall\\,v\_\{i\}\\notin\\mathcal\{K\}\\big\\\},\\quad\\dim\\mathcal\{S\}\_\{\\kappa\}\(0\)=M\_\{\\mathrm\{e\}\}\-\(N\-\\kappa\)\.\(24\)Atλ\>0\\lambda\>0stealth additionally requires the perturbation to be divergence free, so

𝒮κ​\(λ\)=𝒮κ​\(0\)∩ker⁡\(𝐁\),dim𝒮κ​\(0\)−dim𝒮κ​\(λ\)≤rank⁡\(𝐁\),\\mathcal\{S\}\_\{\\kappa\}\(\\lambda\)=\\mathcal\{S\}\_\{\\kappa\}\(0\)\\cap\\ker\(\\mathbf\{B\}\),\\qquad\\dim\\mathcal\{S\}\_\{\\kappa\}\(0\)\-\\dim\\mathcal\{S\}\_\{\\kappa\}\(\\lambda\)\\;\\leq\\;\\operatorname\{rank\}\(\\mathbf\{B\}\),\(25\)with the inclusion strict whenever𝒮κ​\(0\)⊈ker⁡\(𝐁\)\\mathcal\{S\}\_\{\\kappa\}\(0\)\\not\\subseteq\\ker\(\\mathbf\{B\}\), andrank⁡\(𝐁\)=Mn−1\\operatorname\{rank\}\(\\mathbf\{B\}\)=M\_\{\\mathrm\{n\}\}\-1on a weakly connected graph\.

Two consequences follow, and the second is a warning\. The stealthy set grows one dimension per compromised device while the conservation law removes at mostrank⁡\(𝐁\)\\operatorname\{rank\}\(\\mathbf\{B\}\)of them, so the constraint is guaranteed to bite whenever𝒮κ​\(0\)⊈ker⁡\(𝐁\)\\mathcal\{S\}\_\{\\kappa\}\(0\)\\not\\subseteq\\ker\(\\mathbf\{B\}\)\. But the removable*fraction*,rank⁡\(𝐁\)/\(Me−N\+κ\)\\operatorname\{rank\}\(\\mathbf\{B\}\)/\(M\_\{\\mathrm\{e\}\}\-N\+\\kappa\), is nearly flat on the deployment of Table[2](https://arxiv.org/html/2609.17635#S5.T2), moving only from0\.4100\.410atκ=1\\kappa=1to0\.4090\.409atκ=20\\kappa=20\. Counting dimensions therefore bounds the geometry and not the damage: it cannot by itself predict the decay ofℳ\\mathcal\{M\}reported in Section[5\.4](https://arxiv.org/html/2609.17635#S5.SS4), which must come from*which*directionsker⁡\(𝐁\)\\ker\(\\mathbf\{B\}\)removes rather than from how many\.

###### Remark 1\(Whyℳ≥0\\mathcal\{M\}\\geq 0is empirical\)\.

Proposition[1](https://arxiv.org/html/2609.17635#Thmproposition1)compares the two detectors at a common threshold\. The protocol of Section[4\.4](https://arxiv.org/html/2609.17635#S4.SS4.SSS0.Px1)instead recalibratesηα\\eta\_\{\\alpha\}separately for eachλ\\lambda, so the inclusion does not transfer verbatim and the non\-negativity ofℳ⁡\(κ\)\\mathcal\{M\}\(\\kappa\)is an empirical finding rather than a corollary\. We accept that weaker claim because comparing detectors at a fixed numeric threshold would confound detection power with threshold scale\.

### 3\.6Problem Statements

We can now state what we set out to solve\.

###### Problem 1\(Constrained twin synchronisation\)\.

Given the archival measurement stream, the street graph𝒢\\mathcal\{G\}and exogenous covariates𝐮⁡\(⋅\)\\mathbf\{u\}\(\\cdot\), learn parameters𝛉\\bm\{\\theta\}of \([5](https://arxiv.org/html/2609.17635#S3.E5)\)–\([7](https://arxiv.org/html/2609.17635#S3.E7)\) such that the twin tracks the observed process with calibrated uncertainty while keeping the conservation residual \([10](https://arxiv.org/html/2609.17635#S3.E10)\) small under attack\-free operation\.

###### Problem 2\(Integrity monitoring\)\.

Given the calibrated detector \([17](https://arxiv.org/html/2609.17635#S3.E17)\)–\([19](https://arxiv.org/html/2609.17635#S3.E19)\), minimise the expected detection delay𝔼⁡\[inf\{t≥t0:δ⁡\(t\)=1\}−t0\]\\mathbb\{E\}\\big\[\\,\\inf\\\{t\\geq t\_\{0\}:\\delta\(t\)=1\\\}\-t\_\{0\}\\,\\big\]over the attack families \([13](https://arxiv.org/html/2609.17635#S3.E13)\)–\([16](https://arxiv.org/html/2609.17635#S3.E16)\), subject to the false\-alarm constraint \([20](https://arxiv.org/html/2609.17635#S3.E20)\)\.

###### Problem 3\(Attack\-surface characterisation\)\.

For each access budgetκ\\kappa, computeℐ⋆​\(κ,λ\)\\mathcal\{I\}^\{\\star\}\(\\kappa,\\lambda\)by solving \([22](https://arxiv.org/html/2609.17635#S3.E22)\) and report the attack marginℳ⁡\(κ\)\\mathcal\{M\}\(\\kappa\)of \([23](https://arxiv.org/html/2609.17635#S3.E23)\) as a function ofλ\\lambdaand of the access budgetκ\\kappa\.

Problems[1](https://arxiv.org/html/2609.17635#Thmproblem1)and[2](https://arxiv.org/html/2609.17635#Thmproblem2)are the ones a system operator cares about\. Problem[3](https://arxiv.org/html/2609.17635#Thmproblem3)is the one that tells us whether the physics was worth encoding at all, and it is the question we believe has been missing from the urban\-sensing security literature\.

Table 1:Notation used throughout the paper\.SymbolMeaning𝒱,N\\mathcal\{V\},\\,Nset of pedestrian counters and its cardinality𝒢=\(𝒩,ℰ\)\\mathcal\{G\}=\(\\mathcal\{N\},\\mathcal\{E\}\)directed pedestrian street graph𝐲​\(t\),𝐲~​\(t\)\\mathbf\{y\}\(t\),\\,\\tilde\{\\mathbf\{y\}\}\(t\)clean and corrupted measurement vectorsϕ⁡\(t\)\\bm\{\\phi\}\(t\)latent directed segment flows𝐱​\(t\),𝐱^​\(t∣t\)\\mathbf\{x\}\(t\),\\,\\hat\{\\mathbf\{x\}\}\(t\\mid t\)twin state and its filtered estimate𝐂\\mathbf\{C\}sensor\-to\-segment selection operator𝐁\\mathbf\{B\}node–edge incidence matrix of𝒢\\mathcal\{G\}𝐬⁡\(t\),𝐫⁡\(t\)\\mathbf\{s\}\(t\),\\,\\mathbf\{r\}\(t\)source–sink term and conservation residual𝐚⁡\(t\),𝒦,κ\\mathbf\{a\}\(t\),\\,\\mathcal\{K\},\\,\\kappainjection vector, compromised set, access budgetz⁡\(t\),ηα,δ⁡\(t\)z\(t\),\\,\\eta\_\{\\alpha\},\\,\\delta\(t\)detection score, conformal threshold, alarmλ\\lambdaweight of the conservation term𝒜κ​\(η,λ\)\\mathcal\{A\}\_\{\\kappa\}\(\\eta,\\lambda\)set ofη\\eta\-stealthy attacksℐ⋆,ℳ\\mathcal\{I\}^\{\\star\},\\,\\mathcal\{M\}worst\-case flow corruption and attack margin

## 4Methodology

Section[3](https://arxiv.org/html/2609.17635#S3)stated three problems: synchronising a physics\-constrained twin, monitoring its input for tampering, and measuring how much the physics actually narrows the adversary’s room to manoeuvre\. This section describes the machinery we build to answer them\. We proceed in the order the pipeline runs, and we flag along the way the design choices that a reader might reasonably have made differently\.

### 4\.1Pipeline Overview

Figure 1:Architecture of the physics\-constrained pedestrian twin\. Archived counts and covariates enter through the replay layer, the structural layer supplies the graph operators, the twin predicts and then assimilates, and the detection layer converts two residuals into a calibrated alarm\. The adversary layer sits on the ingestion path and is used for evaluation only\.The system has five components\. A*replay layer*streams archived counts in chronological order, so that the twin never sees the future\. A*structural layer*builds the pedestrian street graph and the operators𝐂\\mathbf\{C\}and𝐁\\mathbf\{B\}of \([4](https://arxiv.org/html/2609.17635#S3.E4)\) and \([9](https://arxiv.org/html/2609.17635#S3.E9)\)\. The*twin*maintains and assimilates the latent state\. A*calibration layer*converts raw residuals into alarms with a controlled false\-alarm rate\. Finally an*adversary layer*synthesises corrupted streams, either from the parametric families \([13](https://arxiv.org/html/2609.17635#S3.E13)\)–\([16](https://arxiv.org/html/2609.17635#S3.E16)\) or by directly solving the stealth\-constrained optimisation \([22](https://arxiv.org/html/2609.17635#S3.E22)\)\. Figure[1](https://arxiv.org/html/2609.17635#S4.F1)shows how the five compose\. Only the adversary layer is absent from a deployed system; everything upstream of it is what an operator would actually run\.

### 4\.2Data Preparation and Graph Construction

#### Temporal alignment\.

Counts are indexed on a strict hourly grid\. Sensors emit no record when no pedestrian passes, so absent rows are semantically zeros rather than missing values, and we impute them as such; genuine outages are a different matter and are identified by the absence of*all*records from a device for a contiguous block exceeding six hours\. Outage blocks are masked out of both training and evaluation, because treating a dead sensor as an attacked sensor would inflate our detection numbers for the wrong reason\.

#### Device churn\.

Counters are added, removed and physically relocated over the life of the deployment\. We therefore work with the maximal subset𝒱stable⊆𝒱\\mathcal\{V\}\_\{\\mathrm\{stable\}\}\\subseteq\\mathcal\{V\}of devices whose recorded position is unchanged across the study period and whose data availability exceeds a coverage thresholdς\\varsigma\. This is a real restriction and we report\|𝒱stable\|\|\\mathcal\{V\}\_\{\\mathrm\{stable\}\}\|explicitly, since a graph built over a churning sensor set would silently break the conservation constraint\.

#### Street graph\.

We extract the pedestrian\-accessible network for the study bounding box from OpenStreetMap\[[33](https://arxiv.org/html/2609.17635#bib.bib46)\]using OSMnx\[[6](https://arxiv.org/html/2609.17635#bib.bib47)\], simplify it to remove interstitial degree\-two nodes, and retain the largest weakly connected component, yielding𝒢=\(𝒩,ℰ\)\\mathcal\{G\}=\(\\mathcal\{N\},\\mathcal\{E\}\)of \([3](https://arxiv.org/html/2609.17635#S3.E3)\)\. Each device in𝒱stable\\mathcal\{V\}\_\{\\mathrm\{stable\}\}is map\-matched to its nearest street, hence to both directed segments of that street, under projected distance, subject to a rejection radiusϱ\\varrho; unmatched devices are dropped\. This populates𝐂\\mathbf\{C\}\. Because the directional split is unobserved, it is identified only through \([9](https://arxiv.org/html/2609.17635#S3.E9)\) and the line\-graph prior, which is a further reason the conservation term carries information the counts do not\.

#### Line graph\.

Because the twin’s state lives on segments rather than junctions, message passing is performed on the line graph

ℒ⁡\(𝒢\)=\(ℰ,ℰℒ\),\(ei,ej\)∈ℰℒ⇔head⁡\(ei\)=tail⁡\(ej\),\\mathcal\{L\}\(\\mathcal\{G\}\)=\\big\(\\mathcal\{E\},\\,\\mathcal\{E\}\_\{\\mathcal\{L\}\}\\big\),\\qquad\(e\_\{i\},e\_\{j\}\)\\in\\mathcal\{E\}\_\{\\mathcal\{L\}\}\\iff\\mathrm\{head\}\(e\_\{i\}\)=\\mathrm\{tail\}\(e\_\{j\}\),\(26\)so that two segments are adjacent exactly when pedestrian traffic can flow from one into the other\. The incidence matrix𝐁\\mathbf\{B\}is built on𝒢\\mathcal\{G\}, the attention operates onℒ⁡\(𝒢\)\\mathcal\{L\}\(\\mathcal\{G\}\), and the two are consistent by construction\.

#### Exogenous covariates\.

𝐮⁡\(t\)\\mathbf\{u\}\(t\)concatenates hourly temperature and precipitation, cyclical encodings of hour\-of\-day and day\-of\-week, and binary indicators for public holidays and scheduled large events\. These are the confounders most likely to be mistaken for tampering, and including them is what allows the detector to attribute a sudden collective drop in counts to rain rather than to an adversary\.

### 4\.3Twin Architecture and Assimilation

#### State representation\.

The latent state factorises over segments,

𝐱⁡\(t\)=\[𝐱1​\(t\),…,𝐱Me​\(t\)\],𝐱e​\(t\)∈ℝdh,\\mathbf\{x\}\(t\)=\\big\[\\,\\mathbf\{x\}\_\{1\}\(t\),\\,\\dots,\\,\\mathbf\{x\}\_\{M\_\{\\mathrm\{e\}\}\}\(t\)\\,\\big\],\\qquad\\mathbf\{x\}\_\{e\}\(t\)\\in\\mathbb\{R\}^\{d\_\{h\}\},\(27\)so thatd=Me​dhd=M\_\{\\mathrm\{e\}\}d\_\{h\}in the notation of \([5](https://arxiv.org/html/2609.17635#S3.E5)\)\. Each segment carries static features \(length, width class, junction degree, nearby point\-of\-interest density\) which are embedded once and concatenated to𝐱e\\mathbf\{x\}\_\{e\}at every layer\.

#### Transition operator\.

f𝜽f\_\{\\bm\{\\theta\}\}is a stack ofLLgraph attention layers onℒ⁡\(𝒢\)\\mathcal\{L\}\(\\mathcal\{G\}\)followed by a gated recurrent update\. Writing𝒩ℒ​\(e\)\\mathcal\{N\}\_\{\\mathcal\{L\}\}\(e\)for the line\-graph neighbourhood of segmentee, layerℓ\\ellcomputes

αe​j\(ℓ\)\\displaystyle\\alpha\_\{ej\}^\{\(\\ell\)\}=exp\(𝐪⊤σ\(𝐖\(ℓ\)\[𝐡e\(ℓ\)∥𝐡j\(ℓ\)\]\)\)∑j′∈𝒩ℒ​\(e\)exp\(𝐪⊤σ\(𝐖\(ℓ\)\[𝐡e\(ℓ\)∥𝐡j′\(ℓ\)\]\)\),\\displaystyle=\\frac\{\\exp\\\!\\big\(\\mathbf\{q\}^\{\\\!\\top\}\\\!\\sigma\\big\(\\mathbf\{W\}^\{\(\\ell\)\}\[\\,\\mathbf\{h\}\_\{e\}^\{\(\\ell\)\}\\,\\\|\\,\\mathbf\{h\}\_\{j\}^\{\(\\ell\)\}\\,\]\\big\)\\big\)\}\{\\sum\_\{j^\{\\prime\}\\in\\mathcal\{N\}\_\{\\mathcal\{L\}\}\(e\)\}\\exp\\\!\\big\(\\mathbf\{q\}^\{\\\!\\top\}\\\!\\sigma\\big\(\\mathbf\{W\}^\{\(\\ell\)\}\[\\,\\mathbf\{h\}\_\{e\}^\{\(\\ell\)\}\\,\\\|\\,\\mathbf\{h\}\_\{j^\{\\prime\}\}^\{\(\\ell\)\}\\,\]\\big\)\\big\)\},\(28\)𝐡e\(ℓ\+1\)\\displaystyle\\mathbf\{h\}\_\{e\}^\{\(\\ell\+1\)\}=σ⁡\(∑j∈𝒩ℒ​\(e\)αe​j\(ℓ\)​𝐖\(ℓ\)​𝐡j\(ℓ\)\),\\displaystyle=\\sigma\\\!\\Big\(\\sum\_\{j\\in\\mathcal\{N\}\_\{\\mathcal\{L\}\}\(e\)\}\\alpha\_\{ej\}^\{\(\\ell\)\}\\,\\mathbf\{W\}^\{\(\\ell\)\}\\mathbf\{h\}\_\{j\}^\{\(\\ell\)\}\\Big\),\(29\)with𝐡e\(0\)=\[𝐱e\(t\)∥𝐮\(t\)\]\\mathbf\{h\}\_\{e\}^\{\(0\)\}=\[\\,\\mathbf\{x\}\_\{e\}\(t\)\\,\\\|\\,\\mathbf\{u\}\(t\)\\,\], and the temporal update is

𝐱e​\(t\+1∣t\)=GRU⁡\(𝐡e\(L\),𝐱e​\(t∣t\)\)\.\\mathbf\{x\}\_\{e\}\(t\+1\\mid t\)=\\mathrm\{GRU\}\\big\(\\mathbf\{h\}\_\{e\}^\{\(L\)\},\\,\\mathbf\{x\}\_\{e\}\(t\\mid t\)\\big\)\.\(30\)We use additive rather than dot\-product attention because the line graph is sparse and irregular, and we found the additive form markedly more stable on low\-traffic segments\.

#### Emission\.

The decoderg𝜽g\_\{\\bm\{\\theta\}\}of \([6](https://arxiv.org/html/2609.17635#S3.E6)\) enforces non\-negativity of flows,

ϕ^e​\(t\)=softplus⁡\(𝐰ϕ⊤​𝐱e​\(t\)\+bϕ\),\\hat\{\\phi\}\_\{e\}\(t\)=\\mathrm\{softplus\}\\big\(\\mathbf\{w\}\_\{\\phi\}^\{\\\!\\top\}\\mathbf\{x\}\_\{e\}\(t\)\+b\_\{\\phi\}\\big\),\(31\)and, because the observations are counts rather than real numbers, the measurement model \([7](https://arxiv.org/html/2609.17635#S3.E7)\) is realised as a negative binomial likelihood with mean𝐂​ϕ^​\(t\)\\mathbf\{C\}\\hat\{\\bm\{\\phi\}\}\(t\)and a learned per\-sensor dispersionφi\\varphi\_\{i\},

yi​\(t\)∼NB⁡\(μi​\(t\)=\[𝐂​ϕ^​\(t\)\]i,φi\)\.y\_\{i\}\(t\)\\;\\sim\\;\\mathrm\{NB\}\\big\(\\mu\_\{i\}\(t\)=\[\\mathbf\{C\}\\hat\{\\bm\{\\phi\}\}\(t\)\]\_\{i\},\\;\\varphi\_\{i\}\\big\)\.\(32\)Overdispersion is severe in this data\. A Gaussian or plain Poisson head produces badly miscalibrated tails on busy retail segments, which in turn poisons the conformal calibration downstream\.

#### Source and sink term\.

𝐬^​\(t\)\\hat\{\\mathbf\{s\}\}\(t\)in \([10](https://arxiv.org/html/2609.17635#S3.E10)\) is produced by a small network over junction features \(entrance count, transit\-stop indicator, car\-park capacity, hour\-of\-day\), squashed into a learned envelope

s^n​\(t\)=s¯n⋅tanh⁡\(MLP𝝍​\(𝐪n,𝐮⁡\(t\)\)\),s¯n≥0\.\\hat\{s\}\_\{n\}\(t\)=\\bar\{s\}\_\{n\}\\cdot\\tanh\\\!\\big\(\\mathrm\{MLP\}\_\{\\bm\{\\psi\}\}\(\\mathbf\{q\}\_\{n\},\\mathbf\{u\}\(t\)\)\\big\),\\qquad\\bar\{s\}\_\{n\}\\geq 0\.\(33\)The envelope matters\. Without an explicit bound, the sink term can absorb arbitrary conservation violations and the constraint becomes vacuous\. We penalises¯n\\bar\{s\}\_\{n\}during training so that the model is pushed to explain flow by transport rather than by invented sources\.

#### Assimilation\.

A forecaster maps history to future\. A twin additionally corrects its belief whenever the world speaks, which is the feedback edge in Figure[1](https://arxiv.org/html/2609.17635#S4.F1)\. After receiving𝐲~​\(t\)\\tilde\{\\mathbf\{y\}\}\(t\)we form the innovation

𝝂⁡\(t\)=𝐲~​\(t\)−𝐂​ϕ^​\(t∣t−1\),\\bm\{\\nu\}\(t\)=\\tilde\{\\mathbf\{y\}\}\(t\)\-\\mathbf\{C\}\\,\\hat\{\\bm\{\\phi\}\}\(t\\mid t\-1\),\(34\)and apply a learned, graph\-localised gain that spreads the correction from metered segments into their unmetered neighbourhood:

𝐱^​\(t∣t\)=𝐱^​\(t∣t−1\)\+∑k=0Kγk​𝐀^k​𝐖g​𝐂⊤​𝝂​\(t\),\\hat\{\\mathbf\{x\}\}\(t\\mid t\)\\;=\\;\\hat\{\\mathbf\{x\}\}\(t\\mid t\-1\)\\;\+\\;\\sum\_\{k=0\}^\{K\}\\gamma\_\{k\}\\,\\hat\{\\mathbf\{A\}\}^\{k\}\\,\\mathbf\{W\}\_\{\\\!\\mathrm\{g\}\}\\,\\mathbf\{C\}^\{\\\!\\top\}\\bm\{\\nu\}\(t\),\(35\)where𝐀^\\hat\{\\mathbf\{A\}\}is the normalised line\-graph adjacency,K=4K=4is the diffusion radius, chosen on the validation slice, and\{γk\}\\\{\\gamma\_\{k\}\\\}are learned scalars\. Equation \([35](https://arxiv.org/html/2609.17635#S4.E35)\) is a learned analogue of a Kalman gain\. It is the mechanism by which a handful of sensors constrain a state defined over thousands of segments, and it is what allows a corruption injected at one device to have, or fail to have, a coherent effect elsewhere in the network\.

### 4\.4Training and Threshold Calibration

Parameters𝜽,𝝍\\bm\{\\theta\},\\bm\{\\psi\}are fitted on the attack\-free training split by minimising

ℒ=ℒobs⏟fit\+λ​ℒcons⏟physics\+μ​ℒsmooth⏟regularity\+ξ​ℒsink⏟parsimony,\\mathcal\{L\}=\\underbrace\{\\mathcal\{L\}\_\{\\mathrm\{obs\}\}\}\_\{\\text\{fit\}\}\+\\lambda\\,\\underbrace\{\\mathcal\{L\}\_\{\\mathrm\{cons\}\}\}\_\{\\text\{physics\}\}\+\\mu\\,\\underbrace\{\\mathcal\{L\}\_\{\\mathrm\{smooth\}\}\}\_\{\\text\{regularity\}\}\+\\xi\\,\\underbrace\{\\mathcal\{L\}\_\{\\mathrm\{sink\}\}\}\_\{\\text\{parsimony\}\},\(36\)whose terms are

ℒobs\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{obs\}\}=−1\|𝒯\|​N∑t∈𝒯∑i=1Nmi\(t\)logpNB\(yi\(t\)\|μi\(t\),φi\),\\displaystyle=\-\\frac\{1\}\{\|\\mathcal\{T\}\|\\,N\}\\sum\_\{t\\in\\mathcal\{T\}\}\\sum\_\{i=1\}^\{N\}m\_\{i\}\(t\)\\,\\log p\_\{\\mathrm\{NB\}\}\\big\(y\_\{i\}\(t\)\\,\\big\|\\,\\mu\_\{i\}\(t\),\\varphi\_\{i\}\\big\),\(37\)ℒcons\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{cons\}\}=1\|𝒯\|​Mn​∑t∈𝒯‖𝐁​ϕ^​\(t\)−𝐬^​\(t\)‖22,\\displaystyle=\\frac\{1\}\{\|\\mathcal\{T\}\|\\,M\_\{\\mathrm\{n\}\}\}\\sum\_\{t\\in\\mathcal\{T\}\}\\big\\\|\\mathbf\{B\}\\hat\{\\bm\{\\phi\}\}\(t\)\-\\hat\{\\mathbf\{s\}\}\(t\)\\big\\\|\_\{2\}^\{2\},\(38\)ℒsmooth\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{smooth\}\}=1\|𝒯\|​∑t∈𝒯‖ϕ^​\(t\)−ϕ^​\(t−1\)‖22,\\displaystyle=\\frac\{1\}\{\|\\mathcal\{T\}\|\}\\sum\_\{t\\in\\mathcal\{T\}\}\\big\\\|\\hat\{\\bm\{\\phi\}\}\(t\)\-\\hat\{\\bm\{\\phi\}\}\(t\-1\)\\big\\\|\_\{2\}^\{2\},\(39\)ℒsink\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{sink\}\}=1Mn​∑n∈𝒩s¯n,\\displaystyle=\\frac\{1\}\{M\_\{\\mathrm\{n\}\}\}\\sum\_\{n\\in\\mathcal\{N\}\}\\bar\{s\}\_\{n\},\(40\)
withmi​\(t\)∈\{0,1\}m\_\{i\}\(t\)\\in\\\{0,1\\\}the outage mask\. The weightλ\\lambdaappears both here and in the detection score \([17](https://arxiv.org/html/2609.17635#S3.E17)\); we writeλtr\\lambda\_\{\\mathrm\{tr\}\}andλdet\\lambda\_\{\\mathrm\{det\}\}where the two roles must be separated and set them equal by default, since a twin trained to respect conservation and then monitored for it is the coherent design\. The roles are nevertheless disentangled factorially in Fig\.[4](https://arxiv.org/html/2609.17635#S5.F4), because otherwise it would be impossible to say whether the gain comes from the learned model or from the detection statistic\.

#### Conformal calibration under drift\.

The split\-conformal threshold \([18](https://arxiv.org/html/2609.17635#S3.E18)\) assumes exchangeability, which hourly pedestrian activity plainly violates\. We therefore run adaptive conformal inference on top of it, updating the nominal level online according to the realised error,

αt\+1=αt\+ϱaci\(α−errt\),errt=𝟏\[z\(t\)\>ηαt\],\\alpha\_\{t\+1\}=\\alpha\_\{t\}\+\\varrho\_\{\\mathrm\{aci\}\}\\big\(\\alpha\-\\mathrm\{err\}\_\{t\}\\big\),\\qquad\\mathrm\{err\}\_\{t\}=\\mathbf\{1\}\\big\[\\,z\(t\)\>\\eta\_\{\\alpha\_\{t\}\}\\,\\big\],\(41\)with step sizeϱaci\>0\\varrho\_\{\\mathrm\{aci\}\}\>0andηαt\\eta\_\{\\alpha\_\{t\}\}recomputed from a rolling calibration buffer\. Under this scheme the long\-run false\-alarm frequency converges toα\\alpharegardless of distribution shift, at the price of losing the finite\-sample guarantee \([20](https://arxiv.org/html/2609.17635#S3.E20)\) at any individual time step\. We report both the marginal and the running empirical coverage so that the reader can see the cost of the trade\. One consequence governs every comparison in Section[5](https://arxiv.org/html/2609.17635#S5):*the threshold is recalibrated separately for every value ofλ\\lambdaand for every baseline*, because comparing detectors at a fixed numeric threshold would confound detection power with threshold scale, whereas comparing them at a fixed calibrated false\-alarm rate does not\.

### 4\.5Adversary Layer

#### Parametric attacks\.

Families \(A1\)–\(A3\) are instantiated over a grid: replay lagτ∈\{24,168\}\\tau\\in\\\{24,168\\\}hours, ramp magnitudeβ\\betaswept as a fraction of the sensor’s interquartile range with onset ramp lengthρ∈\{1,7,30\}\\rho\\in\\\{1,7,30\\\}days, and scaling factorγ∈\{0\.6,0\.8,1\.25,1\.6\}\\gamma\\in\\\{0\.6,0\.8,1\.25,1\.6\\\}\. Each configuration is applied to compromised sets𝒦\\mathcal\{K\}chosen by four strategies, namely uniformly at random, by highest line\-graph degree, by highest betweenness centrality, and greedily by marginal impact, for budgetsκ\\kapparanging from a single device to a third of the deployment\. Each combination is launched at two hundred onset times drawn uniformly over the test period, so that the reported delay is not an artefact of one hour of the week\.

#### Optimised stealthy attacks\.

Family \(A4\) and the worst\-case problem \([22](https://arxiv.org/html/2609.17635#S3.E22)\) are solved by projected gradient ascent through the differentiable twin\. Letℐ⁡\(𝐚\)\\mathcal\{I\}\(\\mathbf\{a\}\)denote the objective of \([22](https://arxiv.org/html/2609.17635#S3.E22)\)\. We iterate

𝐚\(k\+1\)=Π𝒜κ​\(ηα,λ\)​\(𝐚\(k\)\+ρatk​∇𝐚ℐ​\(𝐚\(k\)\)\),\\mathbf\{a\}^\{\(k\+1\)\}=\\Pi\_\{\\mathcal\{A\}\_\{\\kappa\}\(\\eta\_\{\\alpha\},\\lambda\)\}\\Big\(\\mathbf\{a\}^\{\(k\)\}\+\\rho\_\{\\mathrm\{atk\}\}\\,\\nabla\_\{\\mathbf\{a\}\}\\mathcal\{I\}\\big\(\\mathbf\{a\}^\{\(k\)\}\\big\)\\Big\),\(42\)where the projectionΠ\\Piis applied as a composition of three operators: a support mask enforcingsupp⁡\(𝐚\)⊆𝒦\\operatorname\{supp\}\(\\mathbf\{a\}\)\\subseteq\\mathcal\{K\}, a box projection enforcing the realisability condition \([12](https://arxiv.org/html/2609.17635#S3.E12)\), and a stealth projection that rescales any time slice violating \([21](https://arxiv.org/html/2609.17635#S3.E21)\),

𝐚⁡\(t\)←𝐚⁡\(t\)⋅min⁡\{1,ηαz⁡\(t\)\}\.\\mathbf\{a\}\(t\)\\leftarrow\\mathbf\{a\}\(t\)\\cdot\\min\\\!\\left\\\{1,\\;\\sqrt\{\\frac\{\\eta\_\{\\alpha\}\}\{z\(t\)\}\}\\right\\\}\.\(43\)Integrality of counts is handled with a straight\-through estimator so that gradients survive the rounding in \([15](https://arxiv.org/html/2609.17635#S3.E15)\)\. We also report a Lagrangian variant in which the hard stealth constraint is replaced by a penalty−ν∑tmax\{0,z\(t\)−ηα\}\-\\nu\\sum\_\{t\}\\max\\\{0,z\(t\)\-\\eta\_\{\\alpha\}\\\}, which is easier to optimise and gives a useful sanity check on the projected solution\.

Two caveats belong here rather than in the discussion\. First, \([42](https://arxiv.org/html/2609.17635#S4.E42)\) converges to a local optimum, soℐ⋆\\mathcal\{I\}^\{\\star\}as we compute it is a*lower*bound on the true worst case and the attack margin \([23](https://arxiv.org/html/2609.17635#S3.E23)\) is an estimate rather than a certificate\. Second, the attacker is granted white\-box access to the twin, including𝜽\\bm\{\\theta\}andηα\\eta\_\{\\alpha\}\. This is generous, and intentionally so: a defence that only works against an ignorant adversary is not a defence\.

#### Computing the attack margin\.

For eachκ\\kappawe solve \([22](https://arxiv.org/html/2609.17635#S3.E22)\) twice, once with the constrained detector and once withλ=0\\lambda=0, each with its own conformally calibratedηα\\eta\_\{\\alpha\}at matched false\-alarm rate, and reportℳ⁡\(κ\)\\mathcal\{M\}\(\\kappa\)from \([23](https://arxiv.org/html/2609.17635#S3.E23)\) together with a bootstrap interval over twenty compromised sets drawn per budget, which is what the cost in Table[8](https://arxiv.org/html/2609.17635#S5.T8)covers\.

### 4\.6Baselines, Metrics and Protocol

#### Baselines\.

We compare against classical detectors \(CUSUM, EWMA, PCA, isolation forest\), a resilientℓ1\\ell\_\{1\}state estimator in the sense of[Fawzi et al\. \[14\]](https://arxiv.org/html/2609.17635#bib.bib42), which we report only against the coordinated families since it is designed for adversarial channels rather than for drift, graph\-based cyber\-physical detectors \(GDN, MTAD\-GAT, USAD, TranAD, OmniAnomaly\), recent reconstruction and frequency\-domain models \(DCdetector, MEMTO, TimesNet, ModernTCN, DualTF, DTAAD, CATCH, MtsCID\), and zero\-shot foundation detectors \(DADA, STAR, GPT4TS\)\. Forecast\-residual detectors built on PatchTST, DLinear, iTransformer, N\-BEATS, Graph WaveNet and MTGNN are included as well, since our own detector is partly of that type\. Every method receives identical inputs, identical outage masks and the identical calibration window, and every threshold is set by the procedure of Section[4\.4](https://arxiv.org/html/2609.17635#S4.SS4.SSS0.Px1)rather than by its own published heuristic\. Hyperparameters are tuned on a held\-out validation slice of the training period only\.

Tables[5](https://arxiv.org/html/2609.17635#S5.T5)and[6](https://arxiv.org/html/2609.17635#S5.T6)show the strongest representatives of each family; the full matrix over all methods is released with the code\.

#### Metrics\.

We report affiliation\-basedF1F\_\{1\}andVUS​\-​PR\\mathrm\{VUS\}\\text\{\-\}\\mathrm\{PR\}in the main text, andVUS​\-​ROC\\mathrm\{VUS\}\\text\{\-\}\\mathrm\{ROC\}with PATE in the released result files\. For the security question the primary metric is detection delay,

D=inf\{t≥t0:δ⁡\(t\)=1\}−t0,D=\\inf\\\{\\,t\\geq t\_\{0\}:\\delta\(t\)=1\\,\\\}\-t\_\{0\},\(44\)reported as the median over attacks at a matched false\-alarm rate, averaged over seeds, alongside the fraction of attacks never detected within the horizon; per\-attack interquartile ranges accompany the released results\. Twin fidelity is reported separately as the Kullback–Leibler divergence between the predictive and empirical measurement distributions,

𝒟\(t\)=DKL\(p^t\(𝐲\)∥pt\(𝐲\)\),\\mathcal\{D\}\(t\)=D\_\{\\mathrm\{KL\}\}\\\!\\big\(\\hat\{p\}\_\{t\}\(\\mathbf\{y\}\)\\,\\big\\\|\\,p\_\{t\}\(\\mathbf\{y\}\)\\big\),\(45\)together with CRPS and empirical coverage at nominal levels\. Point\-adjustedF1F\_\{1\}is reported once, in Table[6](https://arxiv.org/html/2609.17635#S5.T6), and only to show what it hides\.

#### Ablations\.

We ablate the conservation weightλ\\lambda, the assimilation update \([35](https://arxiv.org/html/2609.17635#S4.E35)\), the graph, the sink envelopes¯n\\bar\{s\}\_\{n\}and the conformal threshold\. Figure[4](https://arxiv.org/html/2609.17635#S5.F4)gives the variants and the outcome\.

#### Complexity\.

One forward step costs𝒪⁡\(L⁡\(Me​dh2\+\|ℰℒ\|​dh\)\)\\mathcal\{O\}\\big\(L\(M\_\{\\mathrm\{e\}\}d\_\{h\}^\{2\}\+\|\\mathcal\{E\}\_\{\\mathcal\{L\}\}\|d\_\{h\}\)\\big\)for message passing plus𝒪⁡\(K​\|ℰℒ\|​dh\)\\mathcal\{O\}\(K\|\\mathcal\{E\}\_\{\\mathcal\{L\}\}\|d\_\{h\}\)for assimilation, which is linear in the number of segments and therefore scales to city\-sized graphs\. Solving \([42](https://arxiv.org/html/2609.17635#S4.E42)\) multiplies this by the number of ascent iterations and by the attack horizonHH\. Code, the graph construction pipeline, the attack generator and the exact split definitions are released at[Mogollon Gutierrez et al\. \[29\]](https://arxiv.org/html/2609.17635#bib.bib49)\. We also release the directional minute\-level stream we have been harvesting\[[8](https://arxiv.org/html/2609.17635#bib.bib48)\], which the present study does not use but which would let a follow\-up resolve the directional split that \([4](https://arxiv.org/html/2609.17635#S3.E4)\) leaves latent\.

## 5Results

We report five things, in the order a sceptical reader would ask for them\. Whether the twin tracks the city at all, whether its alarm threshold means what it claims to mean, how quickly it notices the four attack families, how much of the adversary’s room to manoeuvre the conservation term removes, and what each component of the design contributes\. Negative outcomes are reported in the same place as positive ones\.

### 5\.1Experimental Setup

#### Hardware and software\.

All experiments run on a single workstation with an Intel Core i9\-14900K, 64 GB of system memory and one NVIDIA RTX 4070 with 12 GB of device memory, under Ubuntu 24\.04 LTS with CUDA 12\.4 and PyTorch 2\.5\. The graph pipeline uses OSMnx\[[6](https://arxiv.org/html/2609.17635#bib.bib47)\]and NetworkX, message passing uses PyTorch Geometric\. Every performance figure in Tables[3](https://arxiv.org/html/2609.17635#S5.T3)–[6](https://arxiv.org/html/2609.17635#S5.T6)and in Figures[2](https://arxiv.org/html/2609.17635#S5.F2)–[4](https://arxiv.org/html/2609.17635#S5.F4)is the mean over five seeds with the sample standard deviation, shown in parentheses in the tables and as error bars or shaded bands in the figures, the only exception being the point\-adjusted column of Table[6](https://arxiv.org/html/2609.17635#S5.T6)\. Table[7](https://arxiv.org/html/2609.17635#S5.T7)is a single deterministic replay of one historical period and admits no seed variation, and deployment statistics and wall\-clock costs are single\-run\. Differences against the strongest baseline in each column are assessed by a paired Wilcoxon signed\-rank test whose pairing unit is the individual attack episode, that is one configuration launched at one onset time on one compromised set, of which every column in Table[5](https://arxiv.org/html/2609.17635#S5.T5)contributes at least two hundred, and only results significant atp<0\.05p<0\.05are set in bold\. Peak device memory during training is 9\.4 GB, so the whole study is reproducible on one consumer card without gradient checkpointing\.

#### Data\.

We use the City of Melbourne Pedestrian Counting System\[[9](https://arxiv.org/html/2609.17635#bib.bib44)\]over 2019\-01\-01 to 2024\-12\-31 at hourly resolution, joined to the published sensor locations\[[10](https://arxiv.org/html/2609.17635#bib.bib45)\]for map matching\. Table[2](https://arxiv.org/html/2609.17635#S5.T2)reports the deployment and graph statistics after the filtering of Section[4\.2](https://arxiv.org/html/2609.17635#S4.SS2)\. The ratio of instrumented segments to total segments is the quantity that matters for this paper\. At1\.18%1\.18\\%, counting both directions of each metered street, the selection operator is far more rank deficient than any transmission or distribution network studied in the false data injection literature, which is exactly the regime in which we expect stealth to be easy and the conservation constraint to be valuable\.

#### Splits\.

Splits are strictly chronological with a rolling origin and no shuffling\. Training covers 2019\-01\-01 to 2022\-06\-30 with the pandemic block removed, calibration covers 2022\-07\-01 to 2022\-12\-31 and satisfies Assumption[1](https://arxiv.org/html/2609.17635#Thmassumption1), and testing covers 2023\-01\-01 to 2024\-12\-31\. The removed block, 2020\-03\-16 to 2021\-10\-21, is retained as a separate evaluation regime in Section[5\.5](https://arxiv.org/html/2609.17635#S5.SS5)\. Attacks are injected only into the test period, and the nominal false\-alarm rate isα=0\.01\\alpha=0\.01throughout\.

Table 2:Deployment and graph statistics after filtering\. Counter statistics are derived from[City of Melbourne \[9\]](https://arxiv.org/html/2609.17635#bib.bib44); graph statistics from OpenStreetMap\[[33](https://arxiv.org/html/2609.17635#bib.bib46)\]\.QuantityValueStudy period2019–2024Sampling interval1 hCounters in the raw archive79Counters after stability filtering61Counters map\-matched successfully58Hourly observations after masking2 926 162Missing or outage fraction4\.1%JunctionsMnM\_\{\\mathrm\{n\}\}4 013Directed segmentsMeM\_\{\\mathrm\{e\}\}9 842Metered directed segments \(22per device\)116Line\-graph adjacencies26 470Instrumented segment fraction1\.18%Median hourly count148Count dispersion \(variance/mean\)21\.7

### 5\.2Twin Fidelity and Threshold Calibration

Before asking whether the twin detects anything, we ask whether it is worth synchronising\. Table[3](https://arxiv.org/html/2609.17635#S5.T3)compares it against recent forecasting models on the clean test period\. Two observations are the point of the table\. First, the twin is competitive but not dominant on pure accuracy, which is expected, since it spends capacity on a latent flow field that the metric does not reward\. Second, it is clearly better calibrated, because the negative binomial head models the overdispersion reported in Table[2](https://arxiv.org/html/2609.17635#S5.T2)while the Gaussian heads do not\. Calibration is what the detector consumes downstream, so this is the column that matters\.

Table 3:Twin fidelity on the attack\-free test period\. MAE and CRPS are lower is better, coverage is closer to nominal is better\. Coverage is empirical coverage of the nominal 90% predictive interval\.ModelYearMAE↓\\downarrowCRPS↓\\downarrowKL↓\\downarrowCoverage @ 90%Params \(M\)DLinear202371\.4 \(0\.6\)57\.6 \(0\.5\)0\.412 \(0\.010\)0\.781 \(0\.009\)0\.03PatchTST202363\.8 \(0\.7\)47\.1 \(0\.6\)0\.351 \(0\.012\)0\.804 \(0\.011\)1\.2TimesNet202362\.1 \(0\.9\)48\.9 \(0\.7\)0\.358 \(0\.014\)0\.797 \(0\.013\)4\.7iTransformer202460\.7 \(0\.5\)44\.6 \(0\.4\)0\.329 \(0\.009\)0\.818 \(0\.008\)2\.1ModernTCN202460\.2 \(0\.6\)46\.3 \(0\.5\)0\.334 \(0\.011\)0\.822 \(0\.010\)3\.4Graph WaveNet201959\.6 \(0\.8\)45\.9 \(0\.6\)0\.312 \(0\.013\)0\.841 \(0\.012\)1\.8MTGNN202058\.9 \(0\.7\)43\.4 \(0\.5\)0\.318 \(0\.010\)0\.829 \(0\.009\)2\.0Ours, forecaster only—58\.4 \(0\.6\)43\.1 \(0\.4\)0\.284 \(0\.008\)0\.872 \(0\.007\)2\.6Ours, full twin,λ=0\\lambda=0—54\.1\(0\.5\)39\.8\(0\.4\)0\.247\(0\.007\)0\.897\(0\.006\)2\.6Ours, full twin,λ=10\\lambda=10—54\.9 \(0\.5\)41\.6 \(0\.4\)0\.258 \(0\.007\)0\.891 \(0\.006\)2\.7The three bottom rows separate two effects\. Moving from the forecaster to theλ=0\\lambda=0twin isolates assimilation: correcting the state with each incoming observation, rather than only rolling the model forward, accounts for a7\.4%7\.4\\%reduction in MAE and most of the calibration gain\. This is the property that makes the object a twin rather than a forecaster, and it is also what allows a corruption at one device to propagate into the estimate of its unmetered neighbourhood\. Moving fromλ=0\\lambda=0toλ=10\\lambda=10then prices the defence: enforcing conservation costs1\.5%1\.5\\%of MAE and0\.0060\.006of coverage, which is the fidelity the security results of Section[5\.4](https://arxiv.org/html/2609.17635#S5.SS4)are bought with\.

#### Unmetered segments\.

Since98\.8%98\.8\\%of segments carry no device, we test whetherϕ^\\hat\{\\bm\{\\phi\}\}is more than a smoothing prior by withholding ten counters from training and calibration and reconstructing their flow from the remaining forty\-eight\. MAE on the withheld devices is 71\.3 \(2\.4\) against 92\.6 \(3\.1\) for graph kriging on the same topology, a23%23\\%reduction, and the advantage decays with line\-graph distance, falling to6%6\\%at three hops and vanishing beyond four\. Assimilation therefore does carry information off the metered segments, but only into their neighbourhood, which bounds what the twin can legitimately claim about the rest of the city\.

Table[4](https://arxiv.org/html/2609.17635#S5.T4)then asks whether the alarm threshold means what it claims\. Split conformal undercovers, because hourly pedestrian activity is not exchangeable with the calibration half\-year, and the adaptive scheme recovers the target at the cost of a threshold that moves\. Every detection comparison that follows is therefore made at a matched*realised*false\-alarm rate of0\.0110\.011, not at a matched nominal one\.

Table 4:Realised false\-alarm rate on the clean test period\. Nominalα=0\.01\\alpha=0\.01\.ThresholdruleRealisedFARDriftrangeRecalib\.Fixed3​σ3\\sigmaresidual0\.047 \(0\.006\)0\.021–0\.083—Fixed5​σ5\\sigmaresidual0\.006 \(0\.001\)0\.001–0\.019—Split conformal0\.024 \(0\.003\)0\.011–0\.0411Adaptive conformal \(ours\)0\.011\(0\.001\)0\.008–0\.014730

### 5\.3Detection Performance

Table[5](https://arxiv.org/html/2609.17635#S5.T5)reports families A1 to A3\. These are the attacks an opportunistic adversary mounts, most modern detectors handle them, and the margin over the strongest recent baselines is small, one to two hours of median delay against CATCH on the replay and scaling families and seven on the ramp, and our unconstrained variant is in fact one hour slower than it on replay\. The table is included because a detector that failed on it would not be worth discussing, and because it exposes the one parametric case that stays hard for everybody\. The thirty\-day ramp of family A2 is detected late by every method, ours included, since at any single hour the injected bias is smaller than the natural hourly variation\.

Table 5:Parametric attack families at matched realised false\-alarm rate 0\.011, budgetκ=5\\kappa=5, compromised set chosen by betweenness centrality\. Delay is the median in hours, Missed the fraction never detected within a 168 h horizon; both are means over five seeds with the sample standard deviation in parentheses\. Per\-attack interquartile ranges are in the released result files\. Bold marks a difference from the best baseline in that column atp<0\.05p<0\.05under a paired Wilcoxon test\.A1 ReplayA2 Ramp, 30 dA3 Scaling,γ=0\.8\\gamma=0\.8DetectorYearDelay↓\\downarrowMissed↓\\downarrowDelay↓\\downarrowMissed↓\\downarrowDelay↓\\downarrowMissed↓\\downarrowCUSUM—43 \(3\.1\)0\.15 \(0\.02\)124 \(9\.6\)0\.48 \(0\.04\)35 \(2\.7\)0\.12 \(0\.02\)EWMA—36 \(2\.7\)0\.12 \(0\.02\)115 \(8\.8\)0\.44 \(0\.04\)29 \(2\.3\)0\.09 \(0\.01\)PCA residual—47 \(3\.8\)0\.18 \(0\.03\)131 \(10\.4\)0\.53 \(0\.05\)38 \(3\.1\)0\.14 \(0\.02\)GDN202125 \(2\.2\)0\.07 \(0\.01\)101 \(7\.9\)0\.37 \(0\.03\)20 \(1\.8\)0\.05 \(0\.01\)TranAD202227 \(2\.4\)0\.08 \(0\.01\)107 \(8\.2\)0\.39 \(0\.03\)22 \(1\.9\)0\.06 \(0\.01\)DCdetector202321 \(1\.9\)0\.06 \(0\.01\)94 \(7\.4\)0\.34 \(0\.03\)17 \(1\.5\)0\.04 \(0\.01\)MEMTO202324 \(2\.1\)0\.07 \(0\.01\)99 \(7\.6\)0\.36 \(0\.03\)19 \(1\.7\)0\.05 \(0\.01\)DTAAD202419 \(1\.7\)0\.05 \(0\.01\)90 \(7\.1\)0\.32 \(0\.03\)15 \(1\.4\)0\.03 \(0\.01\)DualTF202422 \(2\.0\)0\.06 \(0\.01\)96 \(7\.3\)0\.34 \(0\.03\)18 \(1\.6\)0\.04 \(0\.01\)CATCH202517 \(1\.6\)0\.04 \(0\.01\)86 \(6\.8\)0\.30 \(0\.02\)14 \(1\.3\)0\.03 \(0\.01\)MtsCID202520 \(1\.8\)0\.05 \(0\.01\)92 \(7\.0\)0\.33 \(0\.03\)16 \(1\.5\)0\.04 \(0\.01\)DADA, zero shot202531 \(2\.9\)0\.10 \(0\.02\)116 \(9\.1\)0\.42 \(0\.04\)25 \(2\.2\)0\.08 \(0\.01\)Ours,λ=0\\lambda=0—18 \(1\.6\)0\.05 \(0\.01\)88 \(6\.9\)0\.31 \(0\.03\)15 \(1\.4\)0\.03 \(0\.01\)Ours,λ=10\\lambda=10—15\(1\.4\)0\.03\(0\.01\)79\(6\.2\)0\.26\(0\.02\)13\(1\.2\)0\.02\(0\.01\)One caveat on reading this table\. The seed\-to\-seed spread exceeds the gap between neighbouring methods, which is why significance is assessed on paired episodes rather than on the marginal columns: against CATCH the same episode is detected earlier by the constrained detector in71%71\\%of cases, and that paired difference is stable even where the marginal columns overlap\.

Table[6](https://arxiv.org/html/2609.17635#S5.T6)is the central experiment\. Family A4 and the optimised attack of \([22](https://arxiv.org/html/2609.17635#S3.E22)\) produce corruptions that are internally coherent across the compromised sensors, so every detector that tests only for statistical irregularity degrades sharply\. The learned graph detectors degrade with them, which supports the reading of Section[2\.3](https://arxiv.org/html/2609.17635#S2.SS3)that an estimated correlation structure is a prior the adversary can respect rather than a law the adversary must obey\.

Table 6:Coordinated \(A4\) and white\-box optimised attacks at matched realised false\-alarm rate 0\.011, budgetκ=5\\kappa=5\. Aff\-F1 is affiliation\-basedF1F\_\{1\}\. Values are means over five seeds with the sample standard deviation in parentheses\. A dash in a delay column means the attack was never detected within the horizon in the median run\. The last column reports point\-adjustedF1F\_\{1\}for the optimised attack; its seed\-to\-seed variation is below0\.0050\.005everywhere, so no dispersion is shown\.A4 CoordinatedOptimised, white boxDetectorYearAff\-F1↑\\uparrowVUS\-PR↑\\uparrowDelay↓\\downarrowAff\-F1↑\\uparrowVUS\-PR↑\\uparrowDelay↓\\downarrowPA\-F1F\_\{1\}CUSUM—0\.20 \(0\.02\)0\.13 \(0\.01\)152 \(11\.8\)0\.11 \(0\.02\)0\.07 \(0\.01\)—0\.91Resilientℓ1\\ell\_\{1\}20140\.26 \(0\.03\)0\.18 \(0\.02\)141 \(10\.9\)0\.15 \(0\.02\)0\.10 \(0\.02\)—0\.92GDN20210\.34 \(0\.03\)0\.25 \(0\.02\)118 \(9\.2\)0\.19 \(0\.02\)0\.13 \(0\.02\)—0\.93TranAD20220\.32 \(0\.03\)0\.24 \(0\.02\)123 \(9\.5\)0\.18 \(0\.02\)0\.12 \(0\.02\)—0\.92DCdetector20230\.40 \(0\.03\)0\.31 \(0\.03\)105 \(8\.3\)0\.24 \(0\.03\)0\.17 \(0\.02\)—0\.94MEMTO20230\.37 \(0\.03\)0\.29 \(0\.03\)111 \(8\.7\)0\.22 \(0\.02\)0\.16 \(0\.02\)—0\.93DTAAD20240\.43 \(0\.04\)0\.34 \(0\.03\)99 \(7\.8\)0\.26 \(0\.03\)0\.19 \(0\.02\)—0\.94DualTF20240\.41 \(0\.03\)0\.33 \(0\.03\)104 \(8\.1\)0\.25 \(0\.03\)0\.18 \(0\.02\)—0\.94CATCH20250\.46 \(0\.04\)0\.38 \(0\.03\)93 \(7\.4\)0\.28 \(0\.03\)0\.20 \(0\.02\)—0\.95MtsCID20250\.44 \(0\.04\)0\.36 \(0\.03\)97 \(7\.6\)0\.27 \(0\.03\)0\.20 \(0\.02\)—0\.94Ours,λ=0\\lambda=0—0\.45 \(0\.04\)0\.39 \(0\.03\)95 \(7\.5\)0\.28 \(0\.03\)0\.21 \(0\.02\)—0\.95Ours,λ=1\\lambda=1—0\.61 \(0\.04\)0\.54 \(0\.04\)58 \(5\.1\)0\.44 \(0\.04\)0\.36 \(0\.03\)96 \(8\.2\)0\.96Ours,λ=10\\lambda=10—0\.72\(0\.04\)0\.66\(0\.04\)31\(3\.4\)0\.57\(0\.04\)0\.48\(0\.04\)64\(5\.8\)0\.96The resilient estimator of[Fawzi et al\. \[14\]](https://arxiv.org/html/2609.17635#bib.bib42)is the one baseline with a formal guarantee, and it is the clearest illustration of why that guarantee does not reach this setting: its recovery condition requires fewer than half the channels to be corrupted*and*the state to be observable from the rest, and the second half of that condition fails at1\.18%1\.18\\%instrumentation regardless ofκ\\kappa\. Three further readings deserve emphasis\. The row forλ=0\\lambda=0is our own architecture with the physics switched off, and on affiliationF1F\_\{1\}it sits one point*below*CATCH, the strongest 2025 baseline\. The improvement therefore cannot be attributed to the graph attention backbone\. The optimised column is worse than A4 for every method, as it should be, since the adversary there optimises directly against the deployed detector with full knowledge of𝜽\\bm\{\\theta\}andηα\\eta\_\{\\alpha\}\. And the point\-adjusted column is flat at0\.910\.91to0\.960\.96across detectors that differ by a factor of four to five on every other metric, which is the concrete reason we follow[Sarfraz et al\. \[35\]](https://arxiv.org/html/2609.17635#bib.bib38)and[Liu and Paparrizos \[25\]](https://arxiv.org/html/2609.17635#bib.bib39)in refusing it\.

### 5\.4The Attack Margin

Fig\.[2](https://arxiv.org/html/2609.17635#S5.F2)answers Problem[3](https://arxiv.org/html/2609.17635#Thmproblem3)by the procedure of Section[4\.5](https://arxiv.org/html/2609.17635#S4.SS5)\.

Figure 2:Attack marginℳ⁡\(κ\)\\mathcal\{M\}\(\\kappa\)atλ=10\\lambda=10against the fraction of the fleet the adversary controls, from a single device \(κ=1\\kappa=1,1\.7%1\.7\\%\) to a third of the deployment \(κ=20\\kappa=20,34\.5%34\.5\\%\)\. For each budget the attack is solved on twenty distinct compromised sets; the shaded band is a bootstrap95%95\\%interval over those solutions\. The underlying worst\-case corruptionsℐ⋆​\(κ,0\)\\mathcal\{I\}^\{\\star\}\(\\kappa,0\)andℐ⋆​\(κ,10\)\\mathcal\{I\}^\{\\star\}\(\\kappa,10\)of \([22](https://arxiv.org/html/2609.17635#S3.E22)\), measured in misattributed pedestrian\-hours per pedestrian\-hour, accompany the released results\.The margin is strictly positive at every budget, as \([25](https://arxiv.org/html/2609.17635#S3.E25)\) requires, and decays monotonically as the adversary gains access\. The proposition accounts for the sign but deliberately not for the rate: the fraction of stealthy directions removed byker⁡\(𝐁\)\\ker\(\\mathbf\{B\}\)is almost constant inκ\\kappa, so the decay measured here is a statement about the quality of the surviving directions, not their number\. The mechanism is geometric\. With one or two devices the attacker cannot construct a flow perturbation that lies inker⁡\(𝐁\)\\ker\(\\mathbf\{B\}\)and simultaneously moves the state, so the conservation term removes most of the useful attack space\. With a third of the fleet the attacker can assemble a fictitious flow field that is close to divergence free across the compromised region, and the constraint buys much less\. The absolute corruption levels carry the operational reading\. A single compromised device lets an unconstrained twin misattribute9\.4%9\.4\\%of the city’s pedestrian\-hours, and the conservation term cuts that to4\.3%4\.3\\%; twenty devices lift it to62\.8%62\.8\\%, and the term still removes twelve points of it\. The physics is therefore a strong defence against a small compromise and a partial one against a large compromise, and the marginal damage per additional device falls throughout, from0\.0940\.094at the first to0\.0200\.020at the twentieth, because neighbouring sensors share the same four\-hop influence region\.

Figure[3](https://arxiv.org/html/2609.17635#S5.F3)sweeps the constraint weight\. The margin rises from0\.000\.00atλ=0\\lambda=0to0\.390\.39atλ=10\\lambda=10and then falls, while CRPS degrades only from39\.839\.8to41\.641\.6over that range and collapses to63\.563\.5atλ=1000\\lambda=1000, because a very large weight forces the flow field to be divergence free at the expense of matching the counts\. We therefore useλ=10\\lambda=10throughout\.

Figure 3:Effect of the conservation weightλ\\lambdaatκ=5\\kappa=5\. Thresholds are recalibrated at every value ofλ\\lambda\. Error bars are the sample standard deviation over five seeds\. CRPS is lower\-is\-better, coverage is closer\-to\-0\.900\.90\-is\-better, VUS\-PR andℳ\\mathcal\{M\}are higher\-is\-better\.
### 5\.5Ablations and Non\-Adversarial Shift

Figure[4](https://arxiv.org/html/2609.17635#S5.F4)removes one component at a time\. The bar that decides the thesis is the graph ablation\. Replacing the line graph by akk\-nearest neighbour graph on geographic distance keeps most of the detection performance on parametric attacks, where locality is all that is needed, but collapses the attack margin\. The residual remains computable, since thekk\-NN graph has a well\-defined incidence matrix, butker⁡\(𝐁\)\\ker\(\\mathbf\{B\}\)then bears no relation to walkable transport, so what the detector enforces is a smoothness prior rather than a conservation law, and a smoothness prior is something the adversary can satisfy\. The sink ablation is the second most informative\. Without the bounded envelope of \([33](https://arxiv.org/html/2609.17635#S4.E33)\) the source term absorbs conservation violations, the residual goes quiet, and the constraint becomes decorative\.

Figure 4:Ablations atκ=5\\kappa=5,λ=10\\lambda=10\. Left, VUS\-PR under the coordinated family; centre, attack marginℳ\\mathcal\{M\}; right, the change inℳ\\mathcal\{M\}relative to the full model\. Bars are means over five seeds and error bars the sample standard deviation\. The two graph ablations lose the most margin while keeping much of the detection score, which is the separation the paper turns on\.The two factorial bars show that neither role alone suffices, and that they are not additive:0\.150\.15and0\.210\.21separately against0\.390\.39together\. Training alone shapes a flow field the detector never inspects; detection alone inspects a residual the model was never asked to keep small, so its benign variance swamps the adversarial signal\. The constraint has to be present on both sides\.

#### Real distribution shift\.

The last ablation uses the world rather than an injection\. Table[7](https://arxiv.org/html/2609.17635#S5.T7)replays the held\-out pandemic block, in which counts fell by an order of magnitude with no adversary present, and reports the fraction of hours flagged\. No method survives the first month, and we do not present this as a success\. A sudden collective drop is indistinguishable from a coordinated scaling attack on the evidence available in the first days, and the covariates of Section[4\.2](https://arxiv.org/html/2609.17635#S4.SS2)do not include a public health order\. The claim is narrower\. The adaptive threshold reabsorbs the new regime within three weeks, whereas the fixed rule never reabsorbs it at all and the learned baselines need two to three months, which is the difference between an operator who trusts the system and one who switches it off\.

Table 7:False\-alarm rate during the held\-out pandemic regime, 2020\-03\-16 to 2021\-10\-21, no attack injected\. Lower is better\.MethodFirstmonthWholeregimeRecoverytimeFixed5​σ5\\sigmathreshold0\.830\.36—GDN0\.710\.2994 dMtsCID0\.640\.2471 dOurs, split conformal0\.680\.2788 dOurs, adaptive conformal0\.420\.0619 d

### 5\.6Cost and Negative Results

Table[8](https://arxiv.org/html/2609.17635#S5.T8)reports wall\-clock cost on the configuration of Section[5\.1](https://arxiv.org/html/2609.17635#S5.SS1)\. Deployment is inexpensive and the attack surface characterisation is not, which is acceptable because no operator runs it\.

Table 8:Wall\-clock cost on one RTX 4070, 12 GB\.StageCostGraph construction and map matching11 min, CPUTraining, 200 epochs3\.8 hPeak device memory during training9\.4 GBInference and assimilation, per hour21 msConformal recalibration, per step1\.4 msOne optimised attack, 300 ascent steps12 minMargin sweep, 7 budgets×\\times2 detectors×\\times20 sets56 hParametric and A4 sweep, 5 seeds14 hTotal attack\-surface characterisation70 hThree outcomes are negative and we report them here rather than omit them\. The thirty\-day ramp of family A2 is effectively invisible within a one\-week horizon for every method tested\. The margin at large access budgets falls below0\.20\.2, so an adversary who compromises a third of the fleet is not meaningfully constrained by the physics\. And every figure in Fig\.[2](https://arxiv.org/html/2609.17635#S5.F2)was obtained against one specific attacker, for the reason given in Section[4\.5](https://arxiv.org/html/2609.17635#S4.SS5)\. A stronger attack algorithm would lower the margin, and we would regard such a result as a correction rather than a refutation\.

## 6Discussion

The result we consider most useful is not that detection improves but that the improvement can be measured\. A conservation law is not a categorical defence\. It is a constraint with a size, and that size depends on how much of the network the adversary controls\. Reporting it as a single number lets an operator reason about exposure rather than trust a benchmark score\.

Three consequences follow\. First, the graph must be the physical one\. The distance graph in Fig\.[4](https://arxiv.org/html/2609.17635#S5.F4)detects parametric attacks almost as well and defends almost not at all, which suggests that much of the reported value of graph structure in anomaly detection is locality rather than physics\. Second, calibration deserves equal weight with the score\. Our entire advantage during the pandemic regime comes from the threshold rule: with split conformal the same model alarms on68%68\\%of the first month, worse than MtsCID\. Third, \([25](https://arxiv.org/html/2609.17635#S3.E25)\) makes sensor placement a security decision, since which segments are instrumented determines how much ofker⁡\(𝐁\)\\ker\(\\mathbf\{B\}\)the adversary can reach; optimising it is left to future work\.

The limits are real\. The study is one city at hourly resolution, and the source and sink envelope is a learned approximation to entrances and transit stops rather than a measured quantity\. The margin is estimated against one attack algorithm\. And Assumption[1](https://arxiv.org/html/2609.17635#Thmassumption1)remains the weakest link, since an adversary who reaches the calibration archive corrupts the guarantee before the detector ever runs\.

## 7Conclusion

We treated a pedestrian digital twin as something that can be lied to, and asked how much a physical law protects it\. The answer is quantitative\. Encoding flow conservation on the street graph, monitoring its residual alongside the innovation, and calibrating the alarm conformally removes roughly half of the worst\-case flow corruption available to an adversary holding one device, and roughly a fifth of it when a third of the fleet is held\. Against the coordinated injections that motivate the whole construction it also detects three times faster than the strongest published detector we could run, at the same realised false\-alarm rate, while the same architecture with the constraint switched off does not\. The defence is strongest exactly where an incident is most likely and weakest where an incident is already severe\.

Two directions follow directly\. Sensor placement can be optimised for the attack margin rather than for coverage, which turns a security metric into a design objective\. And the same construction applies wherever an urban quantity is conserved on a network, including bicycle counts, transit boardings and metered water, so the question this paper asks of pedestrian counters can be asked of most city sensing\.

## Funding

This research received no external funding\.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper\.

## Data availability

The pedestrian counts\[[9](https://arxiv.org/html/2609.17635#bib.bib44)\]and sensor locations\[[10](https://arxiv.org/html/2609.17635#bib.bib45)\]are published by the City of Melbourne under CC BY 4\.0, and the street network is derived from OpenStreetMap\[[33](https://arxiv.org/html/2609.17635#bib.bib46)\]under ODbL 1\.0\. Code, the graph construction pipeline, the attack generator, the exact split definitions and the harvested directional stream are openly available at[https://github\.com/Homaei/attack\-margin](https://github.com/Homaei/attack-margin), with derived artefacts carrying the licences of their sources\.

## References

- \[1\]A\. A\. Albustami and A\. F\. Taha\(2025\)Breaking the flow and the bank: stealthy cyberattacks on water network hydraulics\.Water Research283,pp\. 123719\.External Links:ISSN 0043\-1354,[Document](https://dx.doi.org/10.1016/j.watres.2025.123719)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p2.1),[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[2\]M\. Altin, A\. Cakir, and B\. U\. Toreyin\(2026\)Time\-series forecasting and evaluation on city sensing data: pedestrian and microclimate benchmarks\.IEEE Access14,pp\. 22618–22629\.External Links:ISSN 2169\-3536,[Document](https://dx.doi.org/10.1109/access.2026.3662469)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p1.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[3\]D\. An, F\. Zhang, F\. Cui, and Q\. Yang\(2024\)Toward data integrity attacks against distributed dynamic state estimation in smart grid\.IEEE Transactions on Automation Science and Engineering21\(1\),pp\. 881–894\.External Links:ISSN 1558\-3783,[Document](https://dx.doi.org/10.1109/tase.2023.3236102)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[4\]M\. Bai, P\. Liu, F\. Lv, D\. Fang, S\. Lv, W\. Zhang, and L\. Sun\(2024\)Adversarial attack against intrusion detectors in cyber\-physical systems with minimal perturbations\.In2024 IEEE International Symposium on Parallel and Distributed Processing with Applications \(ISPA\),pp\. 816–825\.External Links:[Document](https://dx.doi.org/10.1109/ispa63168.2024.00109)Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[5\]V\. Bakhshi, M\. S\. Tushar, S\. Bayldon, S\. W\. O’Brien, R\. Buehler, S\. Hankey, and K\. Nordback\(2025\)Scalable validation of automated bicycle and pedestrian counters: evidence from washington, d\.c\.\.Transportation Research Interdisciplinary Perspectives34,pp\. 101661\.External Links:ISSN 2590\-1982,[Document](https://dx.doi.org/10.1016/j.trip.2025.101661)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[6\]G\. Boeing\(2017\)OSMnx: new methods for acquiring, constructing, analyzing, and visualizing complex street networks\.Computers, Environment and Urban Systems65,pp\. 126–139\.External Links:ISSN 0198\-9715,[Document](https://dx.doi.org/10.1016/j.compenvurbsys.2017.05.004)Cited by:[§4\.2](https://arxiv.org/html/2609.17635#S4.SS2.SSS0.Px3.p1.1),[§5\.1](https://arxiv.org/html/2609.17635#S5.SS1.SSS0.Px1.p1.1)\.
- \[7\]R\. Casadei, G\. Delnevo, R\. Girau, and S\. Mirri\(2026\)Crowd digital twins: motivation, architecture, and roadmap\.Future Generation Computer Systems182,pp\. 108475\.External Links:ISSN 0167\-739X,[Document](https://dx.doi.org/10.1016/j.future.2026.108475)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p1.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[8\]City of Melbourne\(2025\)Pedestrian counting system: live directional counts\.Note:Open Data PlatformLicensed CC BY 4\.0; harvested continuously by the authorsExternal Links:[Link](https://data.melbourne.vic.gov.au/explore/dataset/pedestrian-counting-system-past-hour-counts-per-minute/)Cited by:[§4\.6](https://arxiv.org/html/2609.17635#S4.SS6.SSS0.Px4.p1.1)\.
- \[9\]City of Melbourne\(2025\)Pedestrian counting system: past hourly counts\.Note:Open Data PlatformLicensed CC BY 4\.0External Links:[Link](https://data.melbourne.vic.gov.au/explore/dataset/pedestrian-counting-system-monthly-counts-per-hour/)Cited by:[§3\.1](https://arxiv.org/html/2609.17635#S3.SS1.p1.1),[§5\.1](https://arxiv.org/html/2609.17635#S5.SS1.SSS0.Px2.p1.1),[Table 2](https://arxiv.org/html/2609.17635#S5.T2),[Data availability](https://arxiv.org/html/2609.17635#Sx3.p1.1)\.
- \[10\]City of Melbourne\(2025\)Pedestrian counting system: sensor locations\.Note:Open Data PlatformLicensed CC BY 4\.0External Links:[Link](https://data.melbourne.vic.gov.au/explore/dataset/pedestrian-counting-system-sensor-locations/)Cited by:[§5\.1](https://arxiv.org/html/2609.17635#S5.SS1.SSS0.Px2.p1.1),[Data availability](https://arxiv.org/html/2609.17635#Sx3.p1.1)\.
- \[11\]A\. R\. Diallo, L\. Homri, and J\. Dantan\(2025\)Reducing false alarms in fault detection: a comparative analysis between conformal prediction and classical methods applied to pca and autoencoders\.Journal of Process Control152,pp\. 103495\.External Links:ISSN 0959\-1524,[Document](https://dx.doi.org/10.1016/j.jprocont.2025.103495)Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[12\]M\. Du, Y\. Zhou, C\. Lin, and Q\. Guo\(2026\)Vulnerability of time\-series ai detectors to physics\-informed poisoning attacks\.IEEE Transactions on Smart Grid,pp\. 1–1\.External Links:ISSN 1949\-3061,[Document](https://dx.doi.org/10.1109/tsg.2026.3719426)Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[13\]X\. Du, C\. Zhou, Y\. Tian, and B\. Xu\(2026\)Anomaly detection based on graph neural networks incorporating with domain knowledge for industrial cyber\-physical systems\.Expert Systems with Applications298,pp\. 129645\.External Links:[Document](https://dx.doi.org/10.1016/j.eswa.2025.129645),ISSN 0957\-4174Cited by:[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.
- \[14\]H\. Fawzi, P\. Tabuada, and S\. Diggavi\(2014\)Secure estimation and control for cyber\-physical systems under adversarial attacks\.IEEE Transactions on Automatic Control59\(6\),pp\. 1454–1467\.External Links:ISSN 1558\-2523,[Document](https://dx.doi.org/10.1109/tac.2014.2303233)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1),[§4\.6](https://arxiv.org/html/2609.17635#S4.SS6.SSS0.Px1.p1.1),[§5\.3](https://arxiv.org/html/2609.17635#S5.SS3.p4.1)\.
- \[15\]R\. Gunawardena, N\. Karunanayake, S\. Seneviratne, R\. Masood, and S\. Kahere\(2025\)G\-dcap: stealthy adversarial attacks on multi\-sensor iot systems\.In2025 21st International Conference on Distributed Computing in Smart Systems and the Internet of Things \(DCOSS\-IoT\),pp\. 1–9\.External Links:[Document](https://dx.doi.org/10.1109/dcoss-iot65416.2025.00028)Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[16\]J\. Guo, Y\. Kong, J\. Wang, S\. Li, and L\. Ren\(2026\)NOAE: noise\-optimized adversarial examples for multivariate time series anomaly detection of the industrial internet of things\.IEEE Transactions on Information Forensics and Security21,pp\. 6099–6110\.External Links:[Document](https://dx.doi.org/10.1109/tifs.2026.3705659),ISSN 1556\-6013Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[17\]M\. Homaei, I\. Khazrak, R\. Molano, A\. Caro, and M\. Ávila\(2026\)Graph attention networks with physical constraints for anomaly detection\.ICT Express\.External Links:[Document](https://dx.doi.org/10.1016/j.icte.2026.05.004),ISSN 2405\-9595Cited by:[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.
- \[18\]M\. Homaei, M\. Tarif, P\. G\. Rodríguez, A\. Caro, and M\. Ávila\(2026\)Causal digital twins for cyber–physical security in water systems: a framework for robust anomaly detection\.Machine Learning with Applications23,pp\. 100824\.External Links:ISSN 2666\-8270,[Document](https://dx.doi.org/10.1016/j.mlwa.2025.100824)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[19\]M\. J\. Islam, R\. T\. Meyer, and S\. Bhattacharjee\(2025\)Poisoning attacks against quantile l1 regression in cps anomaly detection frameworks\.InProceedings of the 10th ACM International Workshop on Security and Privacy Analytics,CODASPY ’25,pp\. 38–48\.External Links:[Document](https://dx.doi.org/10.1145/3716815.3729009)Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[20\]K\. Jin, D\. Ye, and T\. Zhang\(2025\)Completely stealthy and energy\-stealthy sensor attacks with constrained channels: existence and design\.IEEE Transactions on Automatic Control70\(7\),pp\. 4759–4765\.External Links:ISSN 2334\-3303,[Document](https://dx.doi.org/10.1109/tac.2025.3535910)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p2.1),[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[21\]M\. Jin, H\. Y\. Koh, Q\. Wen, D\. Zambon, C\. Alippi, G\. I\. Webb, I\. King, and S\. Pan\(2024\)A survey on graph neural networks for time series: forecasting, classification, imputation, and anomaly detection\.IEEE Transactions on Pattern Analysis and Machine Intelligence46\(12\),pp\. 10466–10485\.External Links:ISSN 1939\-3539,[Document](https://dx.doi.org/10.1109/tpami.2024.3443141)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p2.1),[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.
- \[22\]M\. M\. S\. Khan, J\. Giraldo, and M\. Parvania\(2023\)Real\-time cyber attack localization in distribution systems using digital twin reference model\.IEEE Transactions on Power Delivery38\(5\),pp\. 3238–3249\.External Links:ISSN 1937\-4208,[Document](https://dx.doi.org/10.1109/tpwrd.2023.3296312)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[23\]W\. Kritzinger, M\. Karner, G\. Traar, J\. Henjes, and W\. Sihn\(2018\)Digital twin in manufacturing: a categorical literature review and classification\.IFAC\-PapersOnLine51\(11\),pp\. 1016–1022\.External Links:ISSN 2405\-8963,[Document](https://dx.doi.org/10.1016/j.ifacol.2018.08.474)Cited by:[§3\.2](https://arxiv.org/html/2609.17635#S3.SS2.p1.1)\.
- \[24\]H\. Liu, M\. Liu, S\. Peng, Q\. Jiang, Y\. Zhou, and R\. Deng\(2026\)SAAs: vulnerability of learning\-based anomaly detection to stealthy adversarial attacks on grid\-tied photovoltaic systems\.IEEE Transactions on Smart Grid,pp\. 1–1\.External Links:ISSN 1949\-3061,[Document](https://dx.doi.org/10.1109/tsg.2026.3722831)Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[25\]Q\. Liu and J\. Paparrizos\(2024\)The elephant in the room: towards a reliable time\-series anomaly detection benchmark\.InAdvances in Neural Information Processing Systems 37,NeurIPS 2024,pp\. 108231–108261\.External Links:[Document](https://dx.doi.org/10.52202/079017-3437)Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1),[§5\.3](https://arxiv.org/html/2609.17635#S5.SS3.p4.1)\.
- \[26\]S\. Liu, T\. Alpcan, C\. Leckie, and S\. M\. Erfani\(2025\)Fortifying time series: DTW\-certified robust anomaly detection\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,pp\. 1–25\.Cited by:[§2\.5](https://arxiv.org/html/2609.17635#S2.SS5.p1.1)\.
- \[27\]A\. N\. Massaad, A\. Avdalović, P\. Andras, J\. Khoury, and E\. Bou\-Harb\(2026\)Beyond arbitrary thresholds: conformal prediction for trustworthy can bus intrusion detection\.InICC 2026 \- IEEE International Conference on Communications,pp\. 1–6\.External Links:[Document](https://dx.doi.org/10.1109/icc59461.2026.11587647)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p2.1),[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[28\]Y\. Mo, S\. Weerakkody, and B\. Sinopoli\(2015\)Physical authentication of control systems: designing watermarked control inputs to detect counterfeit sensor outputs\.IEEE Control Systems Magazine35\(1\),pp\. 93–109\.External Links:ISSN 1941\-000X,[Document](https://dx.doi.org/10.1109/mcs.2014.2364724)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[29\]O\. Mogollon Gutierrez, N\. Ghasemi, M\. Homaei, A\. Caro, and M\. Avila\(2026\)Physics\-constrained digital twins for sensor integrity in urban pedestrian flow: detecting stealthy false data injection with conformal guarantees\.Note:Software repositoryExternal Links:[Link](https://github.com/Homaei/attack-margin)Cited by:[§4\.6](https://arxiv.org/html/2609.17635#S4.SS6.SSS0.Px4.p1.1)\.
- \[30\]M\. Mudasir, Y\. Asiri, I\. Ameer, M\. S\. A\. Reshan, H\. Almansour, K\. A\. Awan, and A\. Shaikh\(2026\)RBC\-ad: conformal anomaly detection with explicit false\-alarm control for the tennessee eastman process\.Connection Science38\(1\)\.External Links:ISSN 1360\-0494,[Document](https://dx.doi.org/10.1080/09540091.2026.2707826)Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[31\]M\. Napolitano, A\. Somma, A\. De Benedictis, and N\. Mazzocca\(2025\)FlowTwin: a digital twin for traffic flow monitoring\.IEEE Open Journal of Intelligent Transportation Systems6,pp\. 1551–1568\.External Links:ISSN 2687\-7813,[Document](https://dx.doi.org/10.1109/ojits.2025.3637341)Cited by:[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[32\]R\. I\. Oliveira, P\. Orenstein, T\. Ramos, and J\. V\. Romano\(2024\)Split conformal prediction and non\-exchangeable data\.J\. Mach\. Learn\. Res\.25\(1\)\.External Links:ISSN 1532\-4435Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[33\]OpenStreetMap contributors\(2026\)Planet dump retrieved from[https://planet\.openstreetmap\.org](https://planet.openstreetmap.org/)\.Note:Licensed ODbL 1\.0External Links:[Link](https://www.openstreetmap.org/)Cited by:[§3\.1](https://arxiv.org/html/2609.17635#S3.SS1.p2.2),[§4\.2](https://arxiv.org/html/2609.17635#S4.SS2.SSS0.Px3.p1.1),[Table 2](https://arxiv.org/html/2609.17635#S5.T2),[Data availability](https://arxiv.org/html/2609.17635#Sx3.p1.1)\.
- \[34\]D\. J\. Ryan and J\. S\. Benton\(2023\)Using automated active infrared counters to estimate footfall on urban park footpaths: behavioural stability and validity testing\.International Journal of Behavioral Nutrition and Physical Activity20\(1\)\.External Links:ISSN 1479\-5868,[Document](https://dx.doi.org/10.1186/s12966-023-01438-w)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[35\]M\. S\. Sarfraz, M\. Chen, L\. Layer, K\. Peng, and M\. Koulakis\(2024\)Position: quo vadis, unsupervised time series anomaly detection?\.InProceedings of the 41st International Conference on Machine Learning,ICML’24,pp\. 43461 – 43476\.Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1),[§5\.3](https://arxiv.org/html/2609.17635#S5.SS3.p4.1)\.
- \[36\]A\. Sevtsuk, R\. Basu, and B\. Chancey\(2021\)We shape our buildings, but do they then shape us? a longitudinal analysis of pedestrian flows and development activity in melbourne\.PLOS ONE16\(9\),pp\. e0257534\.External Links:ISSN 1932\-6203,[Document](https://dx.doi.org/10.1371/journal.pone.0257534)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p1.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[37\]S\. Sørbø and M\. Ruocco\(2024\)Navigating the metric maze: a taxonomy of evaluation metrics for anomaly detection in time series\.Data Min\. Knowl\. Discov\.38\(3\),pp\. 1027–1068\.External Links:[Document](https://dx.doi.org/10.1007/s10618-023-00988-8)Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[38\]E\. Vincent, M\. Korki, M\. Seyedmahmoudian, A\. Stojcevski, and S\. Mekhilef\(2023\)Detection of false data injection attacks in cyber–physical systems using graph convolutional network\.Electric Power Systems Research217,pp\. 109118\.External Links:ISSN 0378\-7796,[Document](https://dx.doi.org/10.1016/j.epsr.2023.109118)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[39\]Y\. Wu, B\. Sicard, and S\. A\. Gadsden\(2024\)Physics\-informed machine learning: a comprehensive review on applications in anomaly detection and condition monitoring\.Expert Systems with Applications255,pp\. 124678\.External Links:[Document](https://dx.doi.org/10.1016/j.eswa.2024.124678),ISSN 0957\-4174Cited by:[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.
- \[40\]W\. Xia, D\. He, and L\. Yu\(2024\)Locational detection of false data injection attacks in smart grids: a graph convolutional attention network approach\.IEEE Internet of Things Journal11\(6\),pp\. 9324–9337\.External Links:ISSN 2372\-2541,[Document](https://dx.doi.org/10.1109/jiot.2023.3323565)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[41\]C\. Xiao, S\. Lu, M\. Mohammadpourfard, Y\. Weng, M\. Chamana, and S\. Pol\(2026\)ST\-former: a physics\-guided distributionally robust spatio\-temporal framework for reliable fdia detection under distribution shift\.IEEE Access14,pp\. 68738–68754\.External Links:ISSN 2169\-3536,[Document](https://dx.doi.org/10.1109/access.2026.3677643)Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[42\]C\. Xu and Y\. Xie\(2023\)Conformal prediction for time series\.IEEE Transactions on Pattern Analysis and Machine Intelligence45\(10\),pp\. 11575–11587\.External Links:ISSN 1939\-3539,[Document](https://dx.doi.org/10.1109/tpami.2023.3272339)Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[43\]S\. Xu, D\. Ye, G\. Li, and D\. Yang\(2025\)Globally stealthy attacks against distributed state estimation in smart grid\.IEEE Transactions on Automation Science and Engineering22,pp\. 1353–1363\.External Links:ISSN 1558\-3783,[Document](https://dx.doi.org/10.1109/tase.2024.3364231)Cited by:[§2\.2](https://arxiv.org/html/2609.17635#S2.SS2.p1.1)\.
- \[44\]A\. Yano, T\. Amano, and H\. Yamaguchi\(2026\)Real\-time predictive crowd twin platform by efficient data assimilation\.In2026 IEEE 50th Annual Computers, Software, and Applications Conference \(COMPSAC\),pp\. 1363–1372\.External Links:[Document](https://dx.doi.org/10.1109/compsac69091.2026.00181)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p1.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[45\]M\. B\. Yanotti, Y\. Navon, A\. de Silva, S\. Angelopoulos, and S\. Sinclair\(2026\)The walking economy: pedestrian counts as a real\-time indicator of regional economic activity\.Economic Analysis and Policy92,pp\. 641–662\.External Links:ISSN 0313\-5926,[Document](https://dx.doi.org/10.1016/j.eap.2026.06.032)Cited by:[§1](https://arxiv.org/html/2609.17635#S1.p1.1),[§2\.1](https://arxiv.org/html/2609.17635#S2.SS1.p1.1)\.
- \[46\]M\. Zaffran, O\. Feron, Y\. Goude, J\. Josse, and A\. Dieuleveut\(2022\)Adaptive conformal predictions for time series\.InProceedings of the 39th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.162,pp\. 25834–25866\.Cited by:[§2\.4](https://arxiv.org/html/2609.17635#S2.SS4.p1.1)\.
- \[47\]Z\. Zhang, Z\. Geng, and Y\. Han\(2024\)Graph structure change\-based anomaly detection in multivariate time series of industrial processes\.IEEE Transactions on Industrial Informatics20\(4\),pp\. 6457–6466\.External Links:ISSN 1941\-0050,[Document](https://dx.doi.org/10.1109/tii.2023.3347000)Cited by:[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.
- \[48\]Y\. Zheng, H\. Y\. Koh, M\. Jin, L\. Chi, K\. T\. Phan, S\. Pan, Y\. P\. Chen, and W\. Xiang\(2024\)Correlation\-aware spatial–temporal graph learning for multivariate time\-series anomaly detection\.IEEE Transactions on Neural Networks and Learning Systems35\(9\),pp\. 11802–11816\.External Links:ISSN 2162\-2388,[Document](https://dx.doi.org/10.1109/tnnls.2023.3325667)Cited by:[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.
- \[49\]M\. J\. Zideh, P\. Chatterjee, and A\. K\. Srivastava\(2024\)Physics\-informed machine learning for data anomaly detection, classification, localization, and mitigation: a review, challenges, and path forward\.IEEE Access12,pp\. 4597–4617\.External Links:[Document](https://dx.doi.org/10.1109/access.2023.3347989),ISSN 2169\-3536Cited by:[§2\.3](https://arxiv.org/html/2609.17635#S2.SS3.p1.1)\.